@geekmidas/cli 10.0.0-alpha.0 → 10.0.0-alpha.2

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
 import { ConstructGenerator, DEFAULT_CACHE, discover, isPartitionedRoutes } from "./discover-CAlFgYec.mjs";
-import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig, resolveAppSpec } from "./config-D8o6I_7Z.mjs";
+import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig, resolveAppSpec } from "./config-CzWnfcXM.mjs";
 import { allConstructGlobs, getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stripPublicPrefix } from "./workspace-7FqprxuJ.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId, storeHostingerToken } from "./credentials-B5zRHdAl.mjs";
-import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-Dh0Q6HzY.mjs";
+import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-BZcp3CGx.mjs";
 import { createStageSecrets, rotateServicePassword } from "./generator-VE2JrFlY.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-Bi24WfoW.mjs";
-import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-CgpMWMmM.mjs";
+import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-CY9xFkTH.mjs";
 import { withCompute, withRoutes } from "./emit-CiZS_5Ub.mjs";
 import { DokployApi } from "./dokploy-api-aTFPz7_4.mjs";
 import { encryptSecrets } from "./encryption-D-abyhZx.mjs";
@@ -15,7 +15,7 @@ import { CachedStateProvider } from "./CachedStateProvider-DTniehMP.mjs";
 import { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
 import { generateReactQueryCommand } from "./openapi-react-query-Byltvm_7.mjs";
 import "./sync-CmEuNZsB.mjs";
-import { setupCommand, trustCommand } from "./setup-DOsYueeQ.mjs";
+import { setupCommand, trustCommand } from "./setup-Bc73t0ve.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
@@ -43,7 +43,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "9.0.2";
+var version = "10.0.0-alpha.1";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -443,7 +443,7 @@ var CronGenerator = class extends ConstructGenerator {
 		const importPath = relativePath.replace(/\.ts$/, ".js");
 		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
 		const relativeLoggerPath = relative(dirname(handlerPath), context.loggerPath);
-		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/crons';
+		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
 import ${context.loggerImportPattern} from '${relativeLoggerPath}';
@@ -7364,26 +7364,26 @@ const CLI_VERSION = `~${pkg.version}`;
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~9.0.2",
-	"@geekmidas/auth": "~9.0.2",
-	"@geekmidas/cache": "~9.0.2",
-	"@geekmidas/client": "~9.0.2",
-	"@geekmidas/cloud": "~9.0.2",
-	"@geekmidas/constructs": "~9.0.2",
-	"@geekmidas/db": "~9.0.2",
-	"@geekmidas/emailkit": "~9.0.2",
-	"@geekmidas/envkit": "~9.0.2",
-	"@geekmidas/errors": "~9.0.2",
-	"@geekmidas/events": "~9.0.2",
-	"@geekmidas/logger": "~9.0.2",
-	"@geekmidas/manifest": "~9.0.2",
-	"@geekmidas/rate-limit": "~9.0.2",
-	"@geekmidas/schema": "~9.0.2",
-	"@geekmidas/services": "~9.0.2",
-	"@geekmidas/storage": "~9.0.2",
-	"@geekmidas/studio": "~9.0.2",
-	"@geekmidas/telescope": "~9.0.2",
-	"@geekmidas/testkit": "~9.0.2",
+	"@geekmidas/audit": "~10.0.0-alpha.1",
+	"@geekmidas/auth": "~10.0.0-alpha.1",
+	"@geekmidas/cache": "~10.0.0-alpha.1",
+	"@geekmidas/client": "~10.0.0-alpha.1",
+	"@geekmidas/cloud": "~10.0.0-alpha.1",
+	"@geekmidas/constructs": "~10.0.0-alpha.1",
+	"@geekmidas/db": "~10.0.0-alpha.1",
+	"@geekmidas/emailkit": "~10.0.0-alpha.1",
+	"@geekmidas/envkit": "~10.0.0-alpha.1",
+	"@geekmidas/errors": "~10.0.0-alpha.1",
+	"@geekmidas/events": "~10.0.0-alpha.1",
+	"@geekmidas/logger": "~10.0.0-alpha.1",
+	"@geekmidas/manifest": "~10.0.0-alpha.1",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.1",
+	"@geekmidas/schema": "~10.0.0-alpha.1",
+	"@geekmidas/services": "~10.0.0-alpha.1",
+	"@geekmidas/storage": "~10.0.0-alpha.1",
+	"@geekmidas/studio": "~10.0.0-alpha.1",
+	"@geekmidas/telescope": "~10.0.0-alpha.1",
+	"@geekmidas/testkit": "~10.0.0-alpha.1",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -7442,119 +7442,6 @@ function generateAuthAppFiles(options) {
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
-	const envTs = `import { Credentials } from '@geekmidas/envkit/credentials';
-import { EnvironmentParser } from '@geekmidas/envkit';
-
-export const envParser = new EnvironmentParser({ ...process.env, ...Credentials });
-
-// Global config - only minimal shared values
-// Service-specific config should be parsed where needed
-export const config = envParser
-  .create((get) => ({
-    nodeEnv: get('NODE_ENV').enum(['development', 'test', 'production']).default('development'),
-    stage: get('STAGE').enum(['development', 'staging', 'production']).default('development'),
-  }))
-  .parse();
-`;
-	const loggerTs = `import { createLogger } from '@geekmidas/logger/${options.loggerType}';
-
-export const logger = createLogger();
-`;
-	const authTs = `import { betterAuth } from 'better-auth';
-import { magicLink } from 'better-auth/plugins';
-import pg from 'pg';
-import { envParser } from './config/env.ts';
-import { logger } from './config/logger.ts';
-
-// Parse auth-specific config (no defaults - values from secrets)
-const authConfig = envParser
-  .create((get) => ({
-    databaseUrl: get('DATABASE_URL').string(),
-    baseUrl: get('BETTER_AUTH_URL').string(),
-    trustedOrigins: get('BETTER_AUTH_TRUSTED_ORIGINS').string(),
-    secret: get('BETTER_AUTH_SECRET').string(),
-  }))
-  .parse();
-
-export const auth = betterAuth({
-  database: new pg.Pool({
-    connectionString: authConfig.databaseUrl,
-  }),
-  baseURL: authConfig.baseUrl,
-  trustedOrigins: authConfig.trustedOrigins.split(','),
-  secret: authConfig.secret,
-  plugins: [
-    magicLink({
-      sendMagicLink: async ({ email, url }) => {
-        // TODO: Implement email sending using @geekmidas/emailkit
-        // For development, log the magic link
-        logger.info({ email, url }, 'Magic link generated');
-        console.log('\\n================================');
-        console.log('MAGIC LINK FOR:', email);
-        console.log(url);
-        console.log('================================\\n');
-      },
-      expiresIn: 300, // 5 minutes
-    }),
-  ],
-  emailAndPassword: {
-    enabled: false, // Only magic link for now
-  },
-});
-
-export type Auth = typeof auth;
-`;
-	const indexTs = `import { Hono } from 'hono';
-import { cors } from 'hono/cors';
-import { serve } from '@hono/node-server';
-import { auth } from './auth.ts';
-import { envParser } from './config/env.ts';
-import { logger } from './config/logger.ts';
-
-// Parse server config (no defaults - values from secrets)
-const serverConfig = envParser
-  .create((get) => ({
-    port: get('PORT').string().transform(Number),
-    trustedOrigins: get('BETTER_AUTH_TRUSTED_ORIGINS').string(),
-  }))
-  .parse();
-
-const app = new Hono();
-
-// CORS must be registered before routes
-app.use(
-  '/api/auth/*',
-  cors({
-    origin: serverConfig.trustedOrigins.split(','),
-    allowHeaders: ['Content-Type', 'Authorization'],
-    allowMethods: ['POST', 'GET', 'OPTIONS'],
-    credentials: true,
-  }),
-);
-
-// Health check endpoint
-app.get('/health', (c) => {
-  return c.json({
-    status: 'ok',
-    service: 'auth',
-    timestamp: new Date().toISOString(),
-  });
-});
-
-// Mount better-auth handler
-app.on(['POST', 'GET'], '/api/auth/*', (c) => {
-  return auth.handler(c.req.raw);
-});
-
-logger.info({ port: serverConfig.port }, 'Starting auth server');
-
-serve({
-  fetch: app.fetch,
-  port: serverConfig.port,
-}, (info) => {
-  logger.info({ port: info.port }, 'Auth server running');
-});
-`;
 	const gitignore = `node_modules/
 dist/
 .env.local
@@ -7569,22 +7456,6 @@ dist/
 			path: "apps/auth/tsconfig.json",
 			content: `${JSON.stringify(tsConfig, null, 2)}\n`
 		},
-		{
-			path: "apps/auth/src/config/env.ts",
-			content: envTs
-		},
-		{
-			path: "apps/auth/src/config/logger.ts",
-			content: loggerTs
-		},
-		{
-			path: "apps/auth/src/auth.ts",
-			content: authTs
-		},
-		{
-			path: "apps/auth/src/index.ts",
-			content: indexTs
-		},
 		{
 			path: "apps/auth/.gitignore",
 			content: gitignore
@@ -7797,6 +7668,7 @@ export default defineConfig({${options.monorepo ? "" : `
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
+				[`@${options.name}/constructs/*`]: ["../../constructs/*"],
 				[`@${options.name}/*`]: ["../../packages/*/src"]
 			}
 		},
@@ -9191,6 +9063,10 @@ coverage/
 `;
 	const tsConfig = {
 		compilerOptions: {
+			...isFullstack ? {
+				baseUrl: ".",
+				paths: { [`@${options.name}/constructs/*`]: ["./constructs/*"] }
+			} : {},
 			target: "ES2022",
 			module: "NodeNext",
 			moduleResolution: "NodeNext",
@@ -9300,124 +9176,212 @@ export default defineConfig({
 	return files$1;
 }
 /**
-* Generate the frontend app entry for the workspace config based on the
-* selected `frontendFramework`. Defaults to Next.js for backwards compat.
-*/
-function generateFrontendAppEntry(options) {
-	switch (options.frontendFramework) {
-		case "tanstack-start": return `web: {
-      type: 'web',
-      framework: 'tanstack-start',
-      path: 'apps/web',
-      port: 3001,
-      dependencies: ['api', 'auth'],
-      config: {
-        client: './src/config/client.ts',
-        server: './src/config/server.ts',
-      },
-    },`;
-		case "expo": return `app: {
-      type: 'mobile',
-      framework: 'expo',
-      path: 'apps/app',
-      port: 8081,
-      dependencies: ['api', 'auth'],
-    },`;
-		default: return `web: {
-      type: 'web',
-      framework: 'nextjs',
-      path: 'apps/web',
-      port: 3001,
-      dependencies: ['api', 'auth'],
-      config: {
-        client: './src/config/client.ts',
-        server: './src/config/server.ts',
-      },
-    },`;
-	}
-}
-/**
-* Generate gkm.config.ts with defineWorkspace for fullstack template
+* `gkm.config.ts` for the fullstack workspace.
+*
+* What is *not* here is the point. There is no `apps` block: the apps are the
+* constructs that said they have a process — a `RestApi`, a `BetterAuth`, a
+* `StaticSite` — and naming them again here would be the same sentence written
+* twice with only one copy checked.
+*
+* There is no `services` block either unless something non-default was picked.
+* Every key defaults from the deploy target: on a server target a cache is a
+* table in the database that is already there, storage is MinIO, mail is SES.
 */
 function generateWorkspaceConfig(options) {
-	const { telescope, services, deployTarget, routesStructure } = options;
-	const getRoutesGlob = () => {
-		switch (routesStructure) {
-			case "centralized-endpoints": return "./src/endpoints/**/*.ts";
-			case "centralized-routes": return "./src/routes/**/*.ts";
-			case "domain-based": return "./src/**/routes/*.ts";
-		}
-	};
 	let config = `import { defineWorkspace } from '@geekmidas/cli/config';
 
 export default defineWorkspace({
+  // The scope every physical name is built from: \`Database\` becomes
+  // \`production-${options.name}-database\` on Dokploy and on AWS alike.
   name: '${options.name}',
-  apps: {
-    api: {
-      type: 'backend',
-      path: 'apps/api',
-      port: 3000,
-      routes: '${getRoutesGlob()}',
-      envParser: './src/config/env#envParser',
-      logger: './src/config/logger#logger',
-      dependencies: ['auth'],`;
-	if (telescope) config += `
-      telescope: {
-        enabled: true,
-        path: '/__telescope',
-      },`;
-	config += `
-      openapi: {
-        enabled: true,
-      },
-    },
-    auth: {
-      type: 'backend',
-      path: 'apps/auth',
-      port: 3002,
-      entry: './src/index.ts',
-      framework: 'better-auth',
-      envParser: './src/config/env#envParser',
-      logger: './src/config/logger#logger',
-    },
-    ${generateFrontendAppEntry(options)}
-  },
-  shared: {
-    packages: ['packages/*'],
-    models: {
-      path: 'packages/models',
-      schema: 'zod',
-    },
-  },`;
-	if (services.db || services.cache || services.mail || services.storage || services.events) {
-		config += `
-  services: {`;
-		if (services.db) config += `
-    db: true,`;
-		if (services.cache) config += `
-    cache: true,`;
-		if (services.mail) config += `
-    mail: true,`;
-		if (services.storage) config += `
-    storage: true,`;
-		if (services.events) config += `
-    events: '${services.events}',`;
-		config += `
-  },`;
-	}
-	if (deployTarget === "dokploy") config += `
-  deploy: {
-    default: 'dokploy',
-  },`;
-	config += `
+
+  // One glob, every kind. A declared database is why a Postgres exists, a
+  // declared bucket is why MinIO does, a declared topic is why a broker does —
+  // none of it listed here. It is also where the apps come from: a
+  // \`StaticSite\` is an app, and so is every \`RestApi\`.
+  constructs: './constructs/**/*.ts',
+
   secrets: {
     enabled: true,
-  },`;
-	config += `
+  },
 });
 `;
+	if (options.services.events && options.services.events !== "pgboss") config = config.replace("  secrets: {", `  services: {
+    events: '${options.services.events}',
+  },
+
+  secrets: {`);
 	return config;
 }
+/**
+* The workspace's constructs, at its root rather than inside an app.
+*
+* They outlive the app that used them first: a site depending on the API is a
+* fact about the workspace, and a construct reaching across into a sibling
+* app's `src/` to state it is the shape this layout removes. Apps import them
+* through the `@<name>/constructs/*` path the root tsconfig maps.
+*
+* Every one of these is also an answer config used to give: the database is
+* why a Postgres exists, the surface and the site are the apps, and the edges
+* between them are the CORS origins and the build order.
+*/
+function generateRootConstructs(options) {
+	if (!options.monorepo || options.template !== "fullstack") return [];
+	const { name: name$1, services, frontendFramework } = options;
+	const db = databaseFor(name$1);
+	const files$1 = [];
+	files$1.push({
+		path: "constructs/logger.ts",
+		content: `import { createLogger } from '@geekmidas/logger/${options.loggerType}';
+
+/**
+ * The logger every endpoint runs with.
+ *
+ * Named once, here, because the surface carries it. It used to be
+ * \`logger: './src/config/logger#logger'\` in config — a module path the build
+ * printed into each generated handler, checked by nothing and wrong the moment
+ * the file moved.
+ */
+export const logger = createLogger();
+`
+	});
+	files$1.push({
+		path: "constructs/database.ts",
+		content: `import { KyselyDatabase } from '@geekmidas/constructs/database/kysely';
+import type { Generated } from 'kysely';
+
+/** Your database schema. Add tables here. */
+export interface Database {
+  users: {
+    id: Generated<string>;
+    name: string;
+    email: string;
+    created_at: Generated<Date>;
+  };
+}
+
+/**
+ * The database, declared once.
+ *
+ * The container, the database inside it, its roles and schema, and
+ * \`${db.urlKey}\` all derive from this line — which is why nothing lists
+ * \`postgres\` anywhere.
+ */
+export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}');
+
+/**
+ * The auth server's own schema in that same Postgres, with its own role.
+ *
+ * A schema tenant rather than a second database: one container, and a role
+ * whose \`search_path\` is pinned, so Better Auth's tables cannot collide with
+ * the application's.
+ */
+export const authDb = database.schema<Record<string, never>, 'AuthDb'>('AuthDb');
+`
+	});
+	files$1.push({
+		path: "constructs/auth.ts",
+		content: `import { BetterAuth } from '@geekmidas/constructs/auth';
+import { authDb } from './database.ts';
+
+/**
+ * The auth server.
+ *
+ * There is no \`src/index.ts\` to go with this, and that is the point: the
+ * routes are a wildcard, so no glob finds them and the build generates the
+ * entry from this declaration instead. CORS, the trusted origins and the
+ * cookie domain come from whatever declared an edge to it — nobody writes an
+ * origin down.
+ */
+export const auth = new BetterAuth('Auth', {
+  database: authDb,
+  basePath: '/api/auth',
+});
+`
+	});
+	files$1.push({
+		path: "constructs/api.ts",
+		content: `import { RestApi } from '@geekmidas/constructs/rest-api';
+import { auth } from './auth.ts';
+import { logger } from './logger.ts';
+
+/**
+ * The application's HTTP surface — one RestApi, one container.
+ *
+ * No \`app\`: \`Api\` means \`apps/api\`, which the id already said. The
+ * \`code\` glob is here only because this scaffold puts its endpoints under
+ * \`src/\`, where the conventional layout has them at the app root.
+ */
+export const api = new RestApi('Api', {
+  // Typed out rather than omitted: an API that ships open because a field was
+  // left off is the one default worth refusing to have.
+  defaultAuthorizer: 'none',
+
+  // The actual logger, not a path to one.
+  logger,
+
+  app: {
+    code: './src/{endpoints,functions,crons,queues,topics,subscribers}/**/*.ts',
+  },
+}).auth(auth);
+`
+	});
+	const variant = frontendFramework === "tanstack-start" ? "{ variant: 'tanstack' }" : frontendFramework === "expo" ? void 0 : "{ variant: 'next' }";
+	if (variant !== void 0) files$1.push({
+		path: "constructs/site.ts",
+		content: `import { StaticSite } from '@geekmidas/constructs/site';
+import { api } from './api.ts';
+import { auth } from './auth.ts';
+
+/**
+ * The frontend — a construct like any other, which is what makes it an app.
+ *
+ * No \`path\`: \`Web\` means \`apps/web\`. \`.dependsOn()\` is the single fact
+ * behind four things that are hand-maintained otherwise: this site's
+ * build-time API URL, the API's CORS origins, the auth server's trusted
+ * origins, and which generated client lands here.
+ */
+export const web = new StaticSite('Web', ${variant}).dependsOn([api, auth]);
+`
+	});
+	if (services.storage) {
+		const bucket = storageFor(name$1);
+		files$1.push({
+			path: "constructs/storage.ts",
+			content: `import { ObjectStorage } from '@geekmidas/constructs/object-storage';
+
+/** A bucket — MinIO locally, S3 deployed, one declaration for both. */
+export const uploads = new ObjectStorage('${bucket.id}');
+`
+		});
+	}
+	if (services.mail) {
+		const mail = emailFor(name$1);
+		files$1.push({
+			path: "constructs/email.ts",
+			content: `import { Email } from '@geekmidas/constructs/email';
+
+/** Outbound mail — Mailpit locally, SES deployed. */
+export const email = new Email('${mail.id}', { templates: {} });
+`
+		});
+	}
+	if (services.cache) {
+		const kv = cacheFor(name$1);
+		files$1.push({
+			path: "constructs/cache.ts",
+			content: `import { Cache } from '@geekmidas/constructs/cache';
+
+/**
+ * A cache. Which backend serves it follows the deploy target — a table in the
+ * database on a server, Upstash on AWS — so nothing here says where it lives.
+ */
+export const cache = new Cache('${kv.id}');
+`
+		});
+	}
+	return files$1;
+}
 
 //#endregion
 //#region src/init/templates/api.ts
@@ -9484,9 +9448,16 @@ export const logger = createLogger();
 				}
 			}
 		};
-		const apiImport = routesStructure === "domain-based" ? "../../constructs/api.js" : "../constructs/api.js";
+		/**
+		* Where a file at the app's `src/` root reaches a construct.
+		*
+		* A workspace keeps them at its own root, so the app goes through the
+		* `@<name>/constructs/*` alias rather than climbing out with `../../`.
+		*/
+		const constructsImport = (file) => monorepo ? `@${name$1}/constructs/${file}.ts` : `./constructs/${file}.ts`;
+		const apiImport = monorepo ? `@${name$1}/constructs/api.ts` : routesStructure === "domain-based" ? "../../constructs/api.js" : "../constructs/api.js";
 		const files$1 = [
-			{
+			...declares ? [{
 				path: "src/constructs/api.ts",
 				content: `import { RestApi } from '@geekmidas/constructs/rest-api';
 import { logger } from '../config/logger.ts';
@@ -9501,7 +9472,7 @@ export const api = new RestApi('Api', {
   logger,
 });
 `
-			},
+			}] : [],
 			{
 				path: "src/config/env.ts",
 				content: `import { Credentials } from '@geekmidas/envkit/credentials';
@@ -9676,8 +9647,8 @@ export const authService = {
 			files$1.push({
 				path: "src/router.ts",
 				content: `import { UnauthorizedError } from '@geekmidas/errors';
-import { api } from './constructs/api.ts';${options.database ? `
-import { database } from './constructs/database.ts';` : ""}
+import { api } from '${constructsImport("api")}';${options.database ? `
+import { database } from '${constructsImport("database")}';` : ""}
 import { authService, type Session } from './services/auth.ts';
 import { logger } from './config/logger.ts';
 
@@ -9724,8 +9695,8 @@ export const profileEndpoint = sessionRouter
 		}
 		if (!monorepo) files$1.push({
 			path: "src/router.ts",
-			content: `import { api } from './constructs/api.ts';${options.database ? `
-import { database } from './constructs/database.ts';` : ""}
+			content: `import { api } from '${constructsImport("api")}';${options.database ? `
+import { database } from '${constructsImport("database")}';` : ""}
 
 /**
  * The shared endpoint factory.
@@ -13211,7 +13182,11 @@ async function initCommand(projectName, options = {}) {
 		...isMonorepo$1 ? [] : generateDockerFiles(templateOptions, baseTemplate, dbApps)
 	] : [];
 	const dockerFiles = isMonorepo$1 && baseTemplate ? generateDockerFiles(templateOptions, baseTemplate, dbApps) : [];
-	const rootFiles = baseTemplate ? [...generateMonorepoFiles(templateOptions, baseTemplate), ...generateModelsPackage(templateOptions)] : [];
+	const rootFiles = baseTemplate ? [
+		...generateMonorepoFiles(templateOptions, baseTemplate),
+		...generateRootConstructs(templateOptions),
+		...generateModelsPackage(templateOptions)
+	] : [];
 	const webAppFiles = isFullstack ? frontendFramework === "tanstack-start" ? generateTanStackWebFiles(templateOptions) : frontendFramework === "expo" ? generateExpoAppFiles(templateOptions) : generateWebAppFiles(templateOptions) : [];
 	const authAppFiles = isFullstack ? generateAuthAppFiles(templateOptions) : [];
 	const uiPackageFiles = isFullstack ? generateUiPackageFiles(templateOptions) : [];
@@ -13596,7 +13571,7 @@ async function testCommand(options = {}) {
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
 	if (autoSetup) {
-		const { ensureStageSecrets } = await import("./setup-DSutDAlt.mjs");
+		const { ensureStageSecrets } = await import("./setup-DCuudnCl.mjs");
 		const generated = await ensureStageSecrets(stage, cwd);
 		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
@@ -14071,7 +14046,7 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
 		if (secrets) {
-			const { derivedContainers: derivedContainers$1 } = await import("./workspace-yP5AHnrn.mjs");
+			const { derivedContainers: derivedContainers$1 } = await import("./workspace-DK4WWJIn.mjs");
 			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 			if (result) {
 				await writeStageSecrets$1(result.secrets, workspace.root);
@@ -14100,7 +14075,7 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-yP5AHnrn.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-DK4WWJIn.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (result) {
 			secrets = result.secrets;
@@ -14127,7 +14102,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${options.stage}". Run "gkm secrets:init --stage ${options.stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-yP5AHnrn.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-DK4WWJIn.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${options.stage}" are up-to-date`);