@geekmidas/cli 10.0.0-alpha.16 → 10.0.0-alpha.17

package/dist/index.cjs

@@ -2,16 +2,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-BERGFg8v.cjs");
-const require_config = require("./config-Q1rvKHvw.cjs");
-const require_workspace = require("./workspace-mFpI_ky_.cjs");
-const require_credentials = require("./credentials-Q6F0uqJq.cjs");
+const require_config = require("./config-CdTMeMU_.cjs");
+const require_workspace = require("./workspace-B8NLb54N.cjs");
+const require_credentials = require("./credentials-tvyReUAd.cjs");
 const require_generator = require("./generator-Wdfp0jCS.cjs");
-const require_keystore = require("./keystore-DgGRj2Yy.cjs");
-const require_storage = require("./storage-C-30BD1e.cjs");
-const require_openapi = require("./openapi-Dcbme-Us.cjs");
+const require_storage = require("./storage-DgypfSD6.cjs");
+const require_openapi = require("./openapi-BeckoaP9.cjs");
 const require_emit = require("./emit-BdoPFjZf.cjs");
-const require_fullstack_secrets = require("./fullstack-secrets-DXsWO-5m.cjs");
-const require_sync = require("./sync-D7uTIIEi.cjs");
+const require_reconcile = require("./reconcile-Cq4cO83R.cjs");
+const require_transfer = require("./transfer-DdmtKLzi.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
 let node_readline_promises = require("node:readline/promises");
@@ -43,7 +42,7 @@ let node_module = require("node:module");
 let prompts = require("prompts");
 prompts = require_rolldown_runtime.__toESM(prompts, 1);
 //#region package.json
-var version = "10.0.0-alpha.16";
+var version = "10.0.0-alpha.17";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -2614,7 +2613,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BeNDZdHQ.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-mjqGAvu1.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -8312,7 +8311,6 @@ const DEPENDENCY_VERSIONS = {
 	clsx: "~2.1.1",
 	"lucide-react": "~1.48.0",
 	"tailwind-merge": "~3.7.0",
-	"vite-tsconfig-paths": "~5.1.4",
 	"@biomejs/biome": "~2.5.14",
 	"@faker-js/faker": "~10.6.0",
 	turbo: "~2.11.4",
@@ -8323,26 +8321,21 @@ const DEPENDENCY_VERSIONS = {
 	"@types/aws-lambda": "~8.10.163"
 };
 /**
-* The build and test toolchain, at the versions it was already on.
-*
-* Held here so it moves in one place, but not moved yet: it changes how every
-* scaffold compiles and runs, and tranche 2 (#40) moves it together with the
-* repository's own toolchain.
+* The build and test toolchain, at the versions the repository itself builds
+* and tests with (scripts/dependency-versions.json), so a scaffold compiles
+* with the compiler its own `@geekmidas` packages were checked against.
 */
 const TOOLCHAIN_VERSIONS = {
-	typescript: "~5.8.2",
-	tsx: "~4.20.0",
-	esbuild: "~0.27.0",
-	vitest: "~4.0.0",
-	vite: "^7.0.0",
-	"@vitejs/plugin-react": "^4.3.4",
-	storybook: "^8.4.7",
-	"@storybook/addon-a11y": "^8.4.7",
-	"@storybook/addon-essentials": "^8.4.7",
-	"@storybook/addon-interactions": "^8.4.7",
-	"@storybook/react": "^8.4.7",
-	"@storybook/react-vite": "^8.4.7",
-	"vite@storybook": "^6.0.0"
+	typescript: "~7.0.2",
+	tsx: "~4.23.15",
+	esbuild: "~0.28.2",
+	vitest: "~5.0.2",
+	vite: "~8.3.1",
+	"@vitejs/plugin-react": "^6.1.1",
+	storybook: "^10.6.0",
+	"@storybook/addon-docs": "^10.6.0",
+	"@storybook/addon-a11y": "^10.6.0",
+	"@storybook/react-vite": "^10.6.0"
 };
 /**
 * The Expo app's packages, which track an Expo SDK release (55) rather than
@@ -8372,6 +8365,15 @@ const EXPO_VERSIONS = {
 	nativewind: "~4.2.0",
 	tailwindcss: "~3.4.0"
 };
+/**
+* The pnpm a pnpm scaffold runs under, through \`packageManager\`.
+*
+* Pinned in every layout. Without it Corepack takes the newest pnpm, and 11
+* fails the first install on dependencies with build scripts (esbuild) until
+* they are approved — a single-app scaffold that did not pin it could not
+* install at all.
+*/
+const PNPM_VERSION = "pnpm@10.13.1";
 /** The Biome config schema matching the Biome the scaffold installs. */
 const BIOME_SCHEMA = `https://biomejs.dev/schemas/${DEPENDENCY_VERSIONS["@biomejs/biome"].replace(/^[~^]/, "")}/schema.json`;
 //#endregion
@@ -8391,26 +8393,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.16",
-	"@geekmidas/auth": "~10.0.0-alpha.16",
-	"@geekmidas/cache": "~10.0.0-alpha.16",
-	"@geekmidas/client": "~10.0.0-alpha.16",
-	"@geekmidas/cloud": "~10.0.0-alpha.16",
-	"@geekmidas/constructs": "~10.0.0-alpha.16",
-	"@geekmidas/db": "~10.0.0-alpha.16",
-	"@geekmidas/emailkit": "~10.0.0-alpha.16",
-	"@geekmidas/envkit": "~10.0.0-alpha.16",
-	"@geekmidas/errors": "~10.0.0-alpha.16",
-	"@geekmidas/events": "~10.0.0-alpha.16",
-	"@geekmidas/logger": "~10.0.0-alpha.16",
-	"@geekmidas/manifest": "~10.0.0-alpha.16",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.16",
-	"@geekmidas/schema": "~10.0.0-alpha.16",
-	"@geekmidas/services": "~10.0.0-alpha.16",
-	"@geekmidas/storage": "~10.0.0-alpha.16",
-	"@geekmidas/studio": "~10.0.0-alpha.16",
-	"@geekmidas/telescope": "~10.0.0-alpha.16",
-	"@geekmidas/testkit": "~10.0.0-alpha.16",
+	"@geekmidas/audit": "~10.0.0-alpha.17",
+	"@geekmidas/auth": "~10.0.0-alpha.17",
+	"@geekmidas/cache": "~10.0.0-alpha.17",
+	"@geekmidas/client": "~10.0.0-alpha.17",
+	"@geekmidas/cloud": "~10.0.0-alpha.17",
+	"@geekmidas/constructs": "~10.0.0-alpha.17",
+	"@geekmidas/db": "~10.0.0-alpha.17",
+	"@geekmidas/emailkit": "~10.0.0-alpha.17",
+	"@geekmidas/envkit": "~10.0.0-alpha.17",
+	"@geekmidas/errors": "~10.0.0-alpha.17",
+	"@geekmidas/events": "~10.0.0-alpha.17",
+	"@geekmidas/logger": "~10.0.0-alpha.17",
+	"@geekmidas/manifest": "~10.0.0-alpha.17",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.17",
+	"@geekmidas/schema": "~10.0.0-alpha.17",
+	"@geekmidas/services": "~10.0.0-alpha.17",
+	"@geekmidas/storage": "~10.0.0-alpha.17",
+	"@geekmidas/studio": "~10.0.0-alpha.17",
+	"@geekmidas/telescope": "~10.0.0-alpha.17",
+	"@geekmidas/testkit": "~10.0.0-alpha.17",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -8458,7 +8460,6 @@ function generateAuthAppFiles(options) {
 		compilerOptions: {
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
 				[`@${options.name}/*`]: ["../../packages/*/src"]
@@ -8514,10 +8515,10 @@ function stageEnv(stages) {
 * Vitest config content with globalSetup for database-enabled apps
 */
 const vitestConfigContent = `import { defineConfig } from 'vitest/config';
-import tsconfigPaths from 'vite-tsconfig-paths';
 
 export default defineConfig({
-  plugins: [tsconfigPaths()],
+  // Vite resolves tsconfig \`paths\` itself; no plugin needed.
+  resolve: { tsconfigPaths: true },
   test: {
     environment: 'node',
     globalSetup: './test/globalSetup.ts',
@@ -8583,7 +8584,6 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 			resolveJsonModule: true,
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: { "~/*": ["./src/*"] }
 		},
 		include: ["src/**/*.ts"],
@@ -8707,7 +8707,6 @@ function workspaceApiTsConfig(name) {
 		compilerOptions: {
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
 				[`@${name}/constructs/*`]: ["../../constructs/*"],
@@ -8979,6 +8978,32 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
+	const stageSecrets = sst ? `${credentials}
+      # The stage's secrets, from SSM in the account the role belongs to —
+      # pushed there once with \`gkm secrets:push --stage <stage> --profile …\`.
+      # The stage reaches the shell as a variable, never pasted into the script:
+      # on a manual run it is whatever was typed.
+      - name: Stage secrets
+        run: ${pm.exec} gkm secrets:pull --stage "$STAGE"
+        env:
+          STAGE: \${{ matrix.stage }}
+` : `
+      # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
+      # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
+      # gitignored, so a checkout has the key but not the file: set
+      # secrets.store in gkm.config.ts to a store CI can reach before deploying
+      # from here.
+      # Owner-only, as the CLI writes its own keys. The stage reaches the shell
+      # as a variable, never pasted into the script: on a manual run it is
+      # whatever was typed.
+      - name: Stage secrets key
+        run: |
+          mkdir -p -m 700 ~/.gkm/${options.name}
+          (umask 077 && printf '%s' "$KEY" > ~/.gkm/${options.name}/"$STAGE".key)
+        env:
+          KEY: \${{ secrets.GKM_SECRETS_KEY }}
+          STAGE: \${{ matrix.stage }}
+`;
 	const deployEnv = sst ? "" : `
           DOKPLOY_API_TOKEN: \${{ secrets.DOKPLOY_API_TOKEN }}
           DOKPLOY_ENDPOINT: \${{ vars.DOKPLOY_ENDPOINT }}`;
@@ -9060,20 +9085,7 @@ ${pm.setup}
 ${pm.setup}
       - name: Install
         run: ${pm.install}
-
-      # The stage's secrets are committed encrypted; the key never is. Each
-      # environment holds its own as GKM_SECRETS_KEY.
-      # Owner-only, as the CLI writes its own keys. The stage reaches the shell
-      # as a variable, never pasted into the script: on a manual run it is
-      # whatever was typed.
-      - name: Stage secrets key
-        run: |
-          mkdir -p -m 700 ~/.gkm/${options.name}
-          (umask 077 && printf '%s' "$KEY" > ~/.gkm/${options.name}/"$STAGE".key)
-        env:
-          KEY: \${{ secrets.GKM_SECRETS_KEY }}
-          STAGE: \${{ matrix.stage }}
-${credentials}
+${stageSecrets}
       - name: Deploy
         run: ${pm.run} "deploy:$STAGE"
         env:
@@ -9982,7 +9994,7 @@ function generateMonorepoFiles(options, _template) {
 		version: "0.0.1",
 		private: true,
 		type: "module",
-		packageManager: "pnpm@10.13.1",
+		packageManager: PNPM_VERSION,
 		scripts: {
 			dev: isFullstack ? "gkm dev" : "turbo dev",
 			build: isFullstack ? "gkm build" : "turbo build",
@@ -10136,7 +10148,6 @@ ${isSst ? "\n# SST\n.sst/\n" : ""}`;
 	const tsConfig = {
 		compilerOptions: {
 			...isFullstack ? {
-				baseUrl: ".",
 				paths: { [`@${options.name}/constructs/*`]: ["./constructs/*"] },
 				allowImportingTsExtensions: true,
 				noEmit: true
@@ -10286,12 +10297,24 @@ ${workspaceConstructsGlobs(options.routesStructure, (0, node_path.dirname)(optio
   ],
 
   secrets: {
-    enabled: true,
+    enabled: true,${secretsStore(options)}
   },
 });
 `;
 }
 /**
+* Where a deployed stage's secrets live. On AWS that is SSM in the stage's own
+* account, which the deploy job reaches with the role it already assumed; a
+* server target keeps the encrypted local file, the default.
+*/
+function secretsStore(options) {
+	if (options.deployTarget !== "sst" || !options.region) return "";
+	return `
+    // Deployed stages keep their secrets in SSM, in the account each stage
+    // deploys to: \`gkm secrets:push --stage <stage> --profile <profile>\`.
+    store: { provider: 'ssm', region: '${options.region}' },`;
+}
+/**
 * The workspace's constructs, at its root rather than inside an app.
 *
 * They outlive the app that used them first: a site depending on the API is a
@@ -10506,7 +10529,7 @@ const apiTemplate = {
 		const kv = cacheFor();
 		const db = databaseFor();
 		const mail = emailFor();
-		const src = (path) => monorepo ? `~/${path}` : `./${path}`;
+		const src = (path) => `~/${path}`;
 		const declares = !monorepo;
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
@@ -10589,7 +10612,7 @@ export const healthEndpoint = router
     timestamp: new Date().toISOString(),
   }));
 ` : `import { z } from 'zod';
-import { router } from './router.ts';
+import { router } from '~/router.ts';
 
 export const healthEndpoint = router
   .get('/health')
@@ -11050,8 +11073,8 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from './constructs/database.ts';
-import { envParser } from './config/env.ts';
+import type { Database } from '~/constructs/database.ts';
+import { envParser } from '~/config/env.ts';
 
 // The key the database construct publishes — not a hand-written DATABASE_URL.
 const studioConfig = envParser
@@ -11610,7 +11633,6 @@ function generatePackageJson(options, template) {
 		devDependencies["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
 		devDependencies["@faker-js/faker"] = DEPENDENCY_VERSIONS["@faker-js/faker"];
 		devDependencies["kysely-ctl"] = DEPENDENCY_VERSIONS["kysely-ctl"];
-		devDependencies["vite-tsconfig-paths"] = DEPENDENCY_VERSIONS["vite-tsconfig-paths"];
 	}
 	if (monorepo) {
 		delete devDependencies["@biomejs/biome"];
@@ -11635,6 +11657,7 @@ function generatePackageJson(options, template) {
 		version: "0.0.1",
 		private: true,
 		type: "module",
+		...!monorepo && options.packageManager === "pnpm" ? { packageManager: PNPM_VERSION } : {},
 		exports: {
 			"./client": OPENAPI_OUTPUT_PATH,
 			"./endpoints": ENDPOINTS_OUTPUT_PATH
@@ -11843,9 +11866,7 @@ function generateUiPackageFiles(options) {
 		},
 		devDependencies: {
 			"@storybook/addon-a11y": TOOLCHAIN_VERSIONS["@storybook/addon-a11y"],
-			"@storybook/addon-essentials": TOOLCHAIN_VERSIONS["@storybook/addon-essentials"],
-			"@storybook/addon-interactions": TOOLCHAIN_VERSIONS["@storybook/addon-interactions"],
-			"@storybook/react": TOOLCHAIN_VERSIONS["@storybook/react"],
+			"@storybook/addon-docs": TOOLCHAIN_VERSIONS["@storybook/addon-docs"],
 			"@storybook/react-vite": TOOLCHAIN_VERSIONS["@storybook/react-vite"],
 			"@tailwindcss/vite": DEPENDENCY_VERSIONS["@tailwindcss/vite"],
 			"@types/react": DEPENDENCY_VERSIONS["@types/react"],
@@ -11855,7 +11876,7 @@ function generateUiPackageFiles(options) {
 			storybook: TOOLCHAIN_VERSIONS["storybook"],
 			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
 			typescript: TOOLCHAIN_VERSIONS["typescript"],
-			vite: TOOLCHAIN_VERSIONS["vite@storybook"]
+			vite: TOOLCHAIN_VERSIONS["vite"]
 		},
 		peerDependencies: {
 			react: ">=18.0.0",
@@ -11874,7 +11895,6 @@ function generateUiPackageFiles(options) {
 			],
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: { "~/*": ["./src/*"] }
 		},
 		include: ["src/**/*"],
@@ -11909,17 +11929,17 @@ function generateUiPackageFiles(options) {
 
 const config: StorybookConfig = {
   stories: ['../src/**/*.stories.@(ts|tsx)'],
-  addons: [
-    '@storybook/addon-essentials',
-    '@storybook/addon-interactions',
-    '@storybook/addon-a11y',
-  ],
+  // Controls, actions, backgrounds, viewport and interactions are part of
+  // \`storybook\` itself; docs and a11y are add-ons.
+  addons: ['@storybook/addon-docs', '@storybook/addon-a11y'],
   framework: {
     name: '@storybook/react-vite',
     options: {},
   },
-  docs: {
-    autodocs: 'tag',
+  // \`react-docgen\` parses components itself. The TypeScript-based docgen
+  // calls into TypeScript's JavaScript API, which TypeScript 7 no longer ships.
+  typescript: {
+    reactDocgen: 'react-docgen',
   },
   viteFinal: async (config) => {
     // Add Tailwind CSS v4 plugin
@@ -11932,18 +11952,21 @@ const config: StorybookConfig = {
 
 export default config;
 `;
-	const storybookPreview = `import type { Preview } from '@storybook/react';
+	const storybookPreview = `import type { Preview } from '@storybook/react-vite';
 import '../src/styles/globals.css';
 
 const preview: Preview = {
+  // The starting background is a global, not a parameter.
+  initialGlobals: {
+    backgrounds: { value: 'dark' },
+  },
   parameters: {
     backgrounds: {
-      default: 'dark',
-      values: [
-        { name: 'dark', value: '#171717' },
-        { name: 'surface', value: '#1c1c1c' },
-        { name: 'light', value: '#fafafa' },
-      ],
+      options: {
+        dark: { name: 'dark', value: '#171717' },
+        surface: { name: 'surface', value: '#1c1c1c' },
+        light: { name: 'light', value: '#fafafa' },
+      },
     },
     controls: {
       matchers: {
@@ -12106,7 +12129,7 @@ Button.displayName = 'Button';
 
 export { Button, buttonVariants };
 `;
-	const buttonStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const buttonStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Button } from '~/components/ui/button';
 
 const meta: Meta<typeof Button> = {
@@ -12271,7 +12294,7 @@ CardFooter.displayName = 'CardFooter';
 
 export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };
 `;
-	const inputStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const inputStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Input } from '~/components/ui/input';
 
 const meta: Meta<typeof Input> = {
@@ -12325,7 +12348,7 @@ export const WithValue: Story = {
   },
 };
 `;
-	const cardStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const cardStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Button } from '~/components/ui/button';
 import {
   Card,
@@ -12412,7 +12435,7 @@ Label.displayName = LabelPrimitive.Root.displayName;
 
 export { Label };
 `;
-	const labelStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const labelStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Input } from '~/components/ui/input';
 import { Label } from '~/components/ui/label';
 
@@ -12488,7 +12511,7 @@ function Badge({ className, variant, ...props }: BadgeProps) {
 
 export { Badge, badgeVariants };
 `;
-	const badgeStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const badgeStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Badge } from '~/components/ui/badge';
 
 const meta: Meta<typeof Badge> = {
@@ -12564,7 +12587,7 @@ Separator.displayName = SeparatorPrimitive.Root.displayName;
 
 export { Separator };
 `;
-	const separatorStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const separatorStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Separator } from '~/components/ui/separator';
 
 const meta: Meta<typeof Separator> = {
@@ -12669,7 +12692,7 @@ TabsContent.displayName = TabsPrimitive.Content.displayName;
 
 export { Tabs, TabsList, TabsTrigger, TabsContent };
 `;
-	const tabsStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const tabsStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
 import { Button } from '~/components/ui/button';
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from '~/components/ui/card';
@@ -12773,7 +12796,7 @@ TooltipContent.displayName = TooltipPrimitive.Content.displayName;
 
 export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };
 `;
-	const tooltipStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const tooltipStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '~/components/ui/tooltip';
 import { Button } from '~/components/ui/button';
 
@@ -12966,7 +12989,7 @@ export {
   DialogDescription,
 };
 `;
-	const dialogStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const dialogStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import {
   Dialog,
   DialogContent,
@@ -13298,7 +13321,6 @@ export default nextConfig;
 			jsx: "preserve",
 			incremental: true,
 			plugins: [{ name: "next" }],
-			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*", "../../packages/ui/src/*"],
 				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi/api.ts"],
@@ -13593,8 +13615,7 @@ function generateTanStackWebFiles(options) {
 			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
 			tsx: TOOLCHAIN_VERSIONS["tsx"],
 			typescript: TOOLCHAIN_VERSIONS["typescript"],
-			vite: TOOLCHAIN_VERSIONS["vite"],
-			"vite-tsconfig-paths": DEPENDENCY_VERSIONS["vite-tsconfig-paths"]
+			vite: TOOLCHAIN_VERSIONS["vite"]
 		}
 	};
 	const viteConfig = `import { Credentials } from '@geekmidas/envkit/credentials';
@@ -13602,16 +13623,16 @@ import tailwindcss from '@tailwindcss/vite';
 import { tanstackStart } from '@tanstack/react-start/plugin/vite';
 import viteReact from '@vitejs/plugin-react';
 import { defineConfig } from 'vite';
-import tsconfigPaths from 'vite-tsconfig-paths';
 
 export default defineConfig({
+  // Vite resolves tsconfig \`paths\` itself; no plugin needed.
+  resolve: { tsconfigPaths: true },
   server: {
     port: Number(Credentials.PORT ?? 3001),
   },
   // VITE_* vars are inlined automatically; no manual loadEnv needed.
   envPrefix: 'VITE_',
   plugins: [
-    tsconfigPaths({ root: import.meta.dirname }),
     tailwindcss(),
     tanstackStart(),
     viteReact(),
@@ -13638,7 +13659,6 @@ export default defineConfig({
 			isolatedModules: true,
 			jsx: "preserve",
 			incremental: true,
-			baseUrl: ".",
 			types: ["vite/client"],
 			paths: {
 				"~/*": ["./src/*", "../../packages/ui/src/*"],
@@ -14323,7 +14343,7 @@ async function initCommand(projectName, options = {}) {
 	}
 	devSecrets.custom = customSecrets;
 	await require_storage.writeStageSecrets(devSecrets, targetDir);
-	const keyPath = require_keystore.getKeyPath(local, name);
+	const keyPath = require_storage.getKeyPath(local, name);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -14489,7 +14509,7 @@ async function secretsInitCommand(options) {
 		const loaded = await require_config.loadWorkspaceConfig();
 		projectName = loaded.workspace.name;
 		if (Object.keys(loaded.workspace.apps).length > 1) {
-			workspaceSecrets = require_fullstack_secrets.generateFullstackCustomSecrets(loaded.workspace);
+			workspaceSecrets = require_reconcile.generateFullstackCustomSecrets(loaded.workspace);
 			logger$3.log("  Detected workspace mode — generating per-app secrets");
 		}
 	} catch {}
@@ -14866,7 +14886,7 @@ async function setupCommand(options = {}) {
 	}
 	const containers = await require_credentials.derivedContainers(workspace, stage);
 	if (isMultiApp && containers.includes("postgres")) {
-		await require_fullstack_secrets.writeDockerEnvFromSecrets(secrets, workspace.root);
+		await require_reconcile.writeDockerEnvFromSecrets(secrets, workspace.root);
 		logger$1.log("📄 Generated docker/.env with database passwords");
 	}
 	if (!options.skipDocker) {
@@ -14901,7 +14921,7 @@ async function reconcileLocal(workspace, stage, options) {
 /**
 * Resolve secrets with priority:
 * 1. Local secrets exist → use them (preserves manual additions)
-* 2. SSM configured and has secrets → pull and use
+* 2. A deployed stage whose store has secrets → pull and use
 * 3. Neither → generate fresh secrets
 *
 * --force skips checks 1 and 2 and always regenerates.
@@ -14920,18 +14940,15 @@ async function resolveSecrets(stage, workspace, options) {
 			return reconciled ?? secrets;
 		}
 	}
-	if (require_sync.isSSMConfigured(workspace)) {
-		logger$1.log("☁️  Checking for remote secrets in SSM...");
+	if (require_transfer.isRemoteStore(workspace, stage)) {
+		logger$1.log("☁️  Checking the secrets store...");
 		try {
-			const remoteSecrets = await require_sync.pullSecrets(stage, workspace);
-			if (remoteSecrets) {
-				logger$1.log("✅ Pulled secrets from SSM");
-				await require_storage.writeStageSecrets(remoteSecrets, workspace.root);
-				return remoteSecrets;
-			}
-			logger$1.log("   No remote secrets found");
+			const { secrets } = await require_transfer.pullStageSecrets(workspace, stage);
+			logger$1.log("✅ Pulled secrets from the store");
+			return secrets;
 		} catch (error) {
-			logger$1.warn(`⚠️  Failed to pull from SSM: ${error.message}`);
+			if (error instanceof require_transfer.NoStoredSecrets) logger$1.log("   The store holds none yet");
+			else logger$1.warn(`⚠️  Could not pull from the store: ${error.message}`);
 		}
 	}
 	logger$1.log("🔐 Generating fresh development secrets...");
@@ -15001,7 +15018,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 		changed = true;
 	}
 	if (Object.keys(workspace.apps).length > 1) {
-		const expected = require_fullstack_secrets.generateFullstackCustomSecrets(workspace, containers);
+		const expected = require_reconcile.generateFullstackCustomSecrets(workspace, containers);
 		const missing = {};
 		for (const [key, value] of Object.entries(expected)) if (!(key in result.custom)) missing[key] = value;
 		if (Object.keys(missing).length > 0) {
@@ -15032,7 +15049,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 	const serviceNames = credentialedServices(containers);
 	const secrets = require_generator.createStageSecrets(stage, serviceNames, { projectName: workspace.name });
-	if (Object.keys(workspace.apps).length > 1) secrets.custom = require_fullstack_secrets.generateFullstackCustomSecrets(workspace, containers);
+	if (Object.keys(workspace.apps).length > 1) secrets.custom = require_reconcile.generateFullstackCustomSecrets(workspace, containers);
 	else secrets.custom = {
 		NODE_ENV: "development",
 		PORT: "3000",
@@ -15065,18 +15082,18 @@ async function generateFreshSecrets(stage, workspace, options) {
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_credentials.derivedContainers(workspace, stage));
 	await require_storage.writeStageSecrets(secrets, workspace.root);
 	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (require_sync.isSSMConfigured(workspace) && !options.yes) {
+	if (require_transfer.isRemoteStore(workspace, stage) && !options.yes) {
 		const { shouldPush } = await (0, prompts.default)({
 			type: "confirm",
 			name: "shouldPush",
-			message: "Push secrets to SSM for team sharing?",
+			message: `Push the "${stage}" secrets to its store?`,
 			initial: true
 		});
 		if (shouldPush) try {
-			await require_sync.pushSecrets(stage, workspace);
-			logger$1.log("☁️  Secrets pushed to SSM");
+			await require_transfer.pushStageSecrets(workspace, stage);
+			logger$1.log("☁️  Secrets pushed to the store");
 		} catch (error) {
-			logger$1.warn(`⚠️  Failed to push to SSM: ${error.message}`);
+			logger$1.warn(`⚠️  Could not push to the store: ${error.message}`);
 		}
 	}
 	return secrets;
@@ -15510,7 +15527,7 @@ const program = new commander.Command();
 program.name("gkm").description("GeekMidas backend framework CLI").version(version).option("--cwd <path>", "Change working directory").option("--debug", "Enable debug mode (verbose errors with stack traces)").hook("preAction", () => {
 	if (program.opts().debug);
 });
-program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").action(async (name, options) => {
+program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").action(async (name, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15727,54 +15744,30 @@ program.command("secrets:import").description("Import secrets from a JSON file")
 		process.exit(1);
 	}
 });
-program.command("secrets:push").description("Push secrets to remote provider (SSM)").requiredOption("--stage <stage>", "Stage name").action(async (options) => {
+program.command("secrets:push").description("Send a deployed stage's secrets to its store (secrets.store)").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushSecrets } = await Promise.resolve().then(() => require("./sync-D7uTIIEi.cjs")).then((n) => n.sync_exports);
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-Dd2iyILf.cjs"));
-		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-C-30BD1e.cjs")).then((n) => n.storage_exports);
+		const { pushStageSecrets } = await Promise.resolve().then(() => require("./transfer-DdmtKLzi.cjs")).then((n) => n.transfer_exports);
 		const { workspace } = await loadWorkspaceConfig();
-		const secrets = await readStageSecrets(options.stage, workspace.root);
-		if (secrets) {
-			const { derivedContainers } = await Promise.resolve().then(() => require("./credentials-Q6F0uqJq.cjs")).then((n) => n.workspace_exports);
-			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, options.stage));
-			if (result) {
-				await writeStageSecrets(result.secrets, workspace.root);
-				console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
-				for (const key of result.addedKeys) console.log(`    + ${key}`);
-			}
-		}
-		await pushSecrets(options.stage, workspace);
+		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
+		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
 		console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
-program.command("secrets:pull").description("Pull secrets from remote provider (SSM)").requiredOption("--stage <stage>", "Stage name").action(async (options) => {
+program.command("secrets:pull").description("Bring a deployed stage's secrets from its store into the local copy").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullSecrets } = await Promise.resolve().then(() => require("./sync-D7uTIIEi.cjs")).then((n) => n.sync_exports);
-		const { writeStageSecrets } = await Promise.resolve().then(() => require("./storage-C-30BD1e.cjs")).then((n) => n.storage_exports);
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-Dd2iyILf.cjs"));
+		const { pullStageSecrets } = await Promise.resolve().then(() => require("./transfer-DdmtKLzi.cjs")).then((n) => n.transfer_exports);
 		const { workspace } = await loadWorkspaceConfig();
-		let secrets = await pullSecrets(options.stage, workspace);
-		if (!secrets) {
-			console.error(`No remote secrets found for stage "${options.stage}".`);
-			process.exit(1);
-		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./credentials-Q6F0uqJq.cjs")).then((n) => n.workspace_exports);
-		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, options.stage));
-		if (result) {
-			secrets = result.secrets;
-			console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
-			for (const key of result.addedKeys) console.log(`    + ${key}`);
-		}
-		await writeStageSecrets(secrets, workspace.root);
+		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
+		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
 		console.log(`\n✓ Secrets pulled for stage "${options.stage}"`);
 	} catch (error) {
 		console.error(formatError(error));
@@ -15786,8 +15779,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-Dd2iyILf.cjs"));
-		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-C-30BD1e.cjs")).then((n) => n.storage_exports);
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-Cq4cO83R.cjs")).then((n) => n.reconcile_exports);
+		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-DgypfSD6.cjs")).then((n) => n.storage_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets(stage, workspace.root);
@@ -15795,7 +15788,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./credentials-Q6F0uqJq.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./credentials-tvyReUAd.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -15854,7 +15847,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BfflNPVe.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DVE8Gg_F.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));