@geekmidas/cli 10.0.0-alpha.16 → 10.0.0-alpha.17

package/dist/index.mjs

@@ -1,16 +1,15 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-CK-n3w6b.mjs";
-import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-pqGD3hF9.mjs";
-import { C as InvalidStages, E as stageProblems, O as getPublicEnvPrefix, T as deployedProblems, a as getAppBuildOrder, k as stripPublicPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as assertDeployedStage, y as isDeployTargetSupported } from "./workspace-CgwmXEtc.mjs";
-import { C as storageBackendFor, S as providerOf, _ as LOCAL_CA_PATH, a as loadEnvFiles, b as cacheBackendFor, c as resolveServicePorts, d as constructGlobs, f as derivedContainers, g as COMPOSE_PATH, i as isPortAvailable, l as rewriteUrlsWithPorts, m as usesConstructs, n as createEntryWrapper, o as loadSecretsForApp, p as reconcileWorkspace, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as applyPostgres, x as eventsBackendFor, y as resourceName } from "./credentials-BekkKtY_.mjs";
+import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DPnPkWyH.mjs";
+import { C as InvalidStages, E as stageProblems, O as getPublicEnvPrefix, T as deployedProblems, a as getAppBuildOrder, k as stripPublicPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as assertDeployedStage, y as isDeployTargetSupported } from "./workspace-DI-M3BnN.mjs";
+import { C as storageBackendFor, S as providerOf, _ as LOCAL_CA_PATH, a as loadEnvFiles, b as cacheBackendFor, c as resolveServicePorts, d as constructGlobs, f as derivedContainers, g as COMPOSE_PATH, i as isPortAvailable, l as rewriteUrlsWithPorts, m as usesConstructs, n as createEntryWrapper, o as loadSecretsForApp, p as reconcileWorkspace, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as applyPostgres, x as eventsBackendFor, y as resourceName } from "./credentials-fJP5-fa1.mjs";
 import { a as generateServiceCredentials, i as generateSecurePassword, n as generateConnectionUrls, o as rotateServicePassword, t as createStageSecrets } from "./generator-LfZU7NlU.mjs";
-import { t as getKeyPath } from "./keystore-B4PRlbgE.mjs";
-import { i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-P_b3w7uj.mjs";
-import { a as openapiCommand, c as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as EndpointGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-vy4JzhUv.mjs";
+import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
+import { a as openapiCommand, c as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as EndpointGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DolhBm6r.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
-import { n as writeDockerEnvFromSecrets, t as generateFullstackCustomSecrets } from "./fullstack-secrets-BET8gqwK.mjs";
-import { n as pullSecrets, r as pushSecrets, t as isSSMConfigured } from "./sync-B3xxXtJT.mjs";
+import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-fmoluZmZ.mjs";
+import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-4A4S2hcw.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -38,7 +37,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { lookup } from "node:dns/promises";
 import prompts from "prompts";
 //#region package.json
-var version = "10.0.0-alpha.16";
+var version = "10.0.0-alpha.17";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -2609,7 +2608,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-BodTL4kf.mjs");
+			const { bundleServer } = await import("./bundler-mwH7WOb1.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -8301,7 +8300,6 @@ const DEPENDENCY_VERSIONS = {
 	clsx: "~2.1.1",
 	"lucide-react": "~1.48.0",
 	"tailwind-merge": "~3.7.0",
-	"vite-tsconfig-paths": "~5.1.4",
 	"@biomejs/biome": "~2.5.14",
 	"@faker-js/faker": "~10.6.0",
 	turbo: "~2.11.4",
@@ -8312,26 +8310,21 @@ const DEPENDENCY_VERSIONS = {
 	"@types/aws-lambda": "~8.10.163"
 };
 /**
-* The build and test toolchain, at the versions it was already on.
-*
-* Held here so it moves in one place, but not moved yet: it changes how every
-* scaffold compiles and runs, and tranche 2 (#40) moves it together with the
-* repository's own toolchain.
+* The build and test toolchain, at the versions the repository itself builds
+* and tests with (scripts/dependency-versions.json), so a scaffold compiles
+* with the compiler its own `@geekmidas` packages were checked against.
 */
 const TOOLCHAIN_VERSIONS = {
-	typescript: "~5.8.2",
-	tsx: "~4.20.0",
-	esbuild: "~0.27.0",
-	vitest: "~4.0.0",
-	vite: "^7.0.0",
-	"@vitejs/plugin-react": "^4.3.4",
-	storybook: "^8.4.7",
-	"@storybook/addon-a11y": "^8.4.7",
-	"@storybook/addon-essentials": "^8.4.7",
-	"@storybook/addon-interactions": "^8.4.7",
-	"@storybook/react": "^8.4.7",
-	"@storybook/react-vite": "^8.4.7",
-	"vite@storybook": "^6.0.0"
+	typescript: "~7.0.2",
+	tsx: "~4.23.15",
+	esbuild: "~0.28.2",
+	vitest: "~5.0.2",
+	vite: "~8.3.1",
+	"@vitejs/plugin-react": "^6.1.1",
+	storybook: "^10.6.0",
+	"@storybook/addon-docs": "^10.6.0",
+	"@storybook/addon-a11y": "^10.6.0",
+	"@storybook/react-vite": "^10.6.0"
 };
 /**
 * The Expo app's packages, which track an Expo SDK release (55) rather than
@@ -8361,6 +8354,15 @@ const EXPO_VERSIONS = {
 	nativewind: "~4.2.0",
 	tailwindcss: "~3.4.0"
 };
+/**
+* The pnpm a pnpm scaffold runs under, through \`packageManager\`.
+*
+* Pinned in every layout. Without it Corepack takes the newest pnpm, and 11
+* fails the first install on dependencies with build scripts (esbuild) until
+* they are approved — a single-app scaffold that did not pin it could not
+* install at all.
+*/
+const PNPM_VERSION = "pnpm@10.13.1";
 /** The Biome config schema matching the Biome the scaffold installs. */
 const BIOME_SCHEMA = `https://biomejs.dev/schemas/${DEPENDENCY_VERSIONS["@biomejs/biome"].replace(/^[~^]/, "")}/schema.json`;
 //#endregion
@@ -8380,26 +8382,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.16",
-	"@geekmidas/auth": "~10.0.0-alpha.16",
-	"@geekmidas/cache": "~10.0.0-alpha.16",
-	"@geekmidas/client": "~10.0.0-alpha.16",
-	"@geekmidas/cloud": "~10.0.0-alpha.16",
-	"@geekmidas/constructs": "~10.0.0-alpha.16",
-	"@geekmidas/db": "~10.0.0-alpha.16",
-	"@geekmidas/emailkit": "~10.0.0-alpha.16",
-	"@geekmidas/envkit": "~10.0.0-alpha.16",
-	"@geekmidas/errors": "~10.0.0-alpha.16",
-	"@geekmidas/events": "~10.0.0-alpha.16",
-	"@geekmidas/logger": "~10.0.0-alpha.16",
-	"@geekmidas/manifest": "~10.0.0-alpha.16",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.16",
-	"@geekmidas/schema": "~10.0.0-alpha.16",
-	"@geekmidas/services": "~10.0.0-alpha.16",
-	"@geekmidas/storage": "~10.0.0-alpha.16",
-	"@geekmidas/studio": "~10.0.0-alpha.16",
-	"@geekmidas/telescope": "~10.0.0-alpha.16",
-	"@geekmidas/testkit": "~10.0.0-alpha.16",
+	"@geekmidas/audit": "~10.0.0-alpha.17",
+	"@geekmidas/auth": "~10.0.0-alpha.17",
+	"@geekmidas/cache": "~10.0.0-alpha.17",
+	"@geekmidas/client": "~10.0.0-alpha.17",
+	"@geekmidas/cloud": "~10.0.0-alpha.17",
+	"@geekmidas/constructs": "~10.0.0-alpha.17",
+	"@geekmidas/db": "~10.0.0-alpha.17",
+	"@geekmidas/emailkit": "~10.0.0-alpha.17",
+	"@geekmidas/envkit": "~10.0.0-alpha.17",
+	"@geekmidas/errors": "~10.0.0-alpha.17",
+	"@geekmidas/events": "~10.0.0-alpha.17",
+	"@geekmidas/logger": "~10.0.0-alpha.17",
+	"@geekmidas/manifest": "~10.0.0-alpha.17",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.17",
+	"@geekmidas/schema": "~10.0.0-alpha.17",
+	"@geekmidas/services": "~10.0.0-alpha.17",
+	"@geekmidas/storage": "~10.0.0-alpha.17",
+	"@geekmidas/studio": "~10.0.0-alpha.17",
+	"@geekmidas/telescope": "~10.0.0-alpha.17",
+	"@geekmidas/testkit": "~10.0.0-alpha.17",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -8447,7 +8449,6 @@ function generateAuthAppFiles(options) {
 		compilerOptions: {
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
 				[`@${options.name}/*`]: ["../../packages/*/src"]
@@ -8503,10 +8504,10 @@ function stageEnv(stages) {
 * Vitest config content with globalSetup for database-enabled apps
 */
 const vitestConfigContent = `import { defineConfig } from 'vitest/config';
-import tsconfigPaths from 'vite-tsconfig-paths';
 
 export default defineConfig({
-  plugins: [tsconfigPaths()],
+  // Vite resolves tsconfig \`paths\` itself; no plugin needed.
+  resolve: { tsconfigPaths: true },
   test: {
     environment: 'node',
     globalSetup: './test/globalSetup.ts',
@@ -8572,7 +8573,6 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 			resolveJsonModule: true,
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: { "~/*": ["./src/*"] }
 		},
 		include: ["src/**/*.ts"],
@@ -8696,7 +8696,6 @@ function workspaceApiTsConfig(name) {
 		compilerOptions: {
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
 				[`@${name}/constructs/*`]: ["../../constructs/*"],
@@ -8968,6 +8967,32 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
+	const stageSecrets = sst ? `${credentials}
+      # The stage's secrets, from SSM in the account the role belongs to —
+      # pushed there once with \`gkm secrets:push --stage <stage> --profile …\`.
+      # The stage reaches the shell as a variable, never pasted into the script:
+      # on a manual run it is whatever was typed.
+      - name: Stage secrets
+        run: ${pm.exec} gkm secrets:pull --stage "$STAGE"
+        env:
+          STAGE: \${{ matrix.stage }}
+` : `
+      # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
+      # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
+      # gitignored, so a checkout has the key but not the file: set
+      # secrets.store in gkm.config.ts to a store CI can reach before deploying
+      # from here.
+      # Owner-only, as the CLI writes its own keys. The stage reaches the shell
+      # as a variable, never pasted into the script: on a manual run it is
+      # whatever was typed.
+      - name: Stage secrets key
+        run: |
+          mkdir -p -m 700 ~/.gkm/${options.name}
+          (umask 077 && printf '%s' "$KEY" > ~/.gkm/${options.name}/"$STAGE".key)
+        env:
+          KEY: \${{ secrets.GKM_SECRETS_KEY }}
+          STAGE: \${{ matrix.stage }}
+`;
 	const deployEnv = sst ? "" : `
           DOKPLOY_API_TOKEN: \${{ secrets.DOKPLOY_API_TOKEN }}
           DOKPLOY_ENDPOINT: \${{ vars.DOKPLOY_ENDPOINT }}`;
@@ -9049,20 +9074,7 @@ ${pm.setup}
 ${pm.setup}
       - name: Install
         run: ${pm.install}
-
-      # The stage's secrets are committed encrypted; the key never is. Each
-      # environment holds its own as GKM_SECRETS_KEY.
-      # Owner-only, as the CLI writes its own keys. The stage reaches the shell
-      # as a variable, never pasted into the script: on a manual run it is
-      # whatever was typed.
-      - name: Stage secrets key
-        run: |
-          mkdir -p -m 700 ~/.gkm/${options.name}
-          (umask 077 && printf '%s' "$KEY" > ~/.gkm/${options.name}/"$STAGE".key)
-        env:
-          KEY: \${{ secrets.GKM_SECRETS_KEY }}
-          STAGE: \${{ matrix.stage }}
-${credentials}
+${stageSecrets}
       - name: Deploy
         run: ${pm.run} "deploy:$STAGE"
         env:
@@ -9971,7 +9983,7 @@ function generateMonorepoFiles(options, _template) {
 		version: "0.0.1",
 		private: true,
 		type: "module",
-		packageManager: "pnpm@10.13.1",
+		packageManager: PNPM_VERSION,
 		scripts: {
 			dev: isFullstack ? "gkm dev" : "turbo dev",
 			build: isFullstack ? "gkm build" : "turbo build",
@@ -10125,7 +10137,6 @@ ${isSst ? "\n# SST\n.sst/\n" : ""}`;
 	const tsConfig = {
 		compilerOptions: {
 			...isFullstack ? {
-				baseUrl: ".",
 				paths: { [`@${options.name}/constructs/*`]: ["./constructs/*"] },
 				allowImportingTsExtensions: true,
 				noEmit: true
@@ -10275,12 +10286,24 @@ ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).ma
   ],
 
   secrets: {
-    enabled: true,
+    enabled: true,${secretsStore(options)}
   },
 });
 `;
 }
 /**
+* Where a deployed stage's secrets live. On AWS that is SSM in the stage's own
+* account, which the deploy job reaches with the role it already assumed; a
+* server target keeps the encrypted local file, the default.
+*/
+function secretsStore(options) {
+	if (options.deployTarget !== "sst" || !options.region) return "";
+	return `
+    // Deployed stages keep their secrets in SSM, in the account each stage
+    // deploys to: \`gkm secrets:push --stage <stage> --profile <profile>\`.
+    store: { provider: 'ssm', region: '${options.region}' },`;
+}
+/**
 * The workspace's constructs, at its root rather than inside an app.
 *
 * They outlive the app that used them first: a site depending on the API is a
@@ -10495,7 +10518,7 @@ const apiTemplate = {
 		const kv = cacheFor();
 		const db = databaseFor();
 		const mail = emailFor();
-		const src = (path) => monorepo ? `~/${path}` : `./${path}`;
+		const src = (path) => `~/${path}`;
 		const declares = !monorepo;
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
@@ -10578,7 +10601,7 @@ export const healthEndpoint = router
     timestamp: new Date().toISOString(),
   }));
 ` : `import { z } from 'zod';
-import { router } from './router.ts';
+import { router } from '~/router.ts';
 
 export const healthEndpoint = router
   .get('/health')
@@ -11039,8 +11062,8 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from './constructs/database.ts';
-import { envParser } from './config/env.ts';
+import type { Database } from '~/constructs/database.ts';
+import { envParser } from '~/config/env.ts';
 
 // The key the database construct publishes — not a hand-written DATABASE_URL.
 const studioConfig = envParser
@@ -11599,7 +11622,6 @@ function generatePackageJson(options, template) {
 		devDependencies["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
 		devDependencies["@faker-js/faker"] = DEPENDENCY_VERSIONS["@faker-js/faker"];
 		devDependencies["kysely-ctl"] = DEPENDENCY_VERSIONS["kysely-ctl"];
-		devDependencies["vite-tsconfig-paths"] = DEPENDENCY_VERSIONS["vite-tsconfig-paths"];
 	}
 	if (monorepo) {
 		delete devDependencies["@biomejs/biome"];
@@ -11624,6 +11646,7 @@ function generatePackageJson(options, template) {
 		version: "0.0.1",
 		private: true,
 		type: "module",
+		...!monorepo && options.packageManager === "pnpm" ? { packageManager: PNPM_VERSION } : {},
 		exports: {
 			"./client": OPENAPI_OUTPUT_PATH,
 			"./endpoints": ENDPOINTS_OUTPUT_PATH
@@ -11832,9 +11855,7 @@ function generateUiPackageFiles(options) {
 		},
 		devDependencies: {
 			"@storybook/addon-a11y": TOOLCHAIN_VERSIONS["@storybook/addon-a11y"],
-			"@storybook/addon-essentials": TOOLCHAIN_VERSIONS["@storybook/addon-essentials"],
-			"@storybook/addon-interactions": TOOLCHAIN_VERSIONS["@storybook/addon-interactions"],
-			"@storybook/react": TOOLCHAIN_VERSIONS["@storybook/react"],
+			"@storybook/addon-docs": TOOLCHAIN_VERSIONS["@storybook/addon-docs"],
 			"@storybook/react-vite": TOOLCHAIN_VERSIONS["@storybook/react-vite"],
 			"@tailwindcss/vite": DEPENDENCY_VERSIONS["@tailwindcss/vite"],
 			"@types/react": DEPENDENCY_VERSIONS["@types/react"],
@@ -11844,7 +11865,7 @@ function generateUiPackageFiles(options) {
 			storybook: TOOLCHAIN_VERSIONS["storybook"],
 			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
 			typescript: TOOLCHAIN_VERSIONS["typescript"],
-			vite: TOOLCHAIN_VERSIONS["vite@storybook"]
+			vite: TOOLCHAIN_VERSIONS["vite"]
 		},
 		peerDependencies: {
 			react: ">=18.0.0",
@@ -11863,7 +11884,6 @@ function generateUiPackageFiles(options) {
 			],
 			noEmit: true,
 			allowImportingTsExtensions: true,
-			baseUrl: ".",
 			paths: { "~/*": ["./src/*"] }
 		},
 		include: ["src/**/*"],
@@ -11898,17 +11918,17 @@ function generateUiPackageFiles(options) {
 
 const config: StorybookConfig = {
   stories: ['../src/**/*.stories.@(ts|tsx)'],
-  addons: [
-    '@storybook/addon-essentials',
-    '@storybook/addon-interactions',
-    '@storybook/addon-a11y',
-  ],
+  // Controls, actions, backgrounds, viewport and interactions are part of
+  // \`storybook\` itself; docs and a11y are add-ons.
+  addons: ['@storybook/addon-docs', '@storybook/addon-a11y'],
   framework: {
     name: '@storybook/react-vite',
     options: {},
   },
-  docs: {
-    autodocs: 'tag',
+  // \`react-docgen\` parses components itself. The TypeScript-based docgen
+  // calls into TypeScript's JavaScript API, which TypeScript 7 no longer ships.
+  typescript: {
+    reactDocgen: 'react-docgen',
   },
   viteFinal: async (config) => {
     // Add Tailwind CSS v4 plugin
@@ -11921,18 +11941,21 @@ const config: StorybookConfig = {
 
 export default config;
 `;
-	const storybookPreview = `import type { Preview } from '@storybook/react';
+	const storybookPreview = `import type { Preview } from '@storybook/react-vite';
 import '../src/styles/globals.css';
 
 const preview: Preview = {
+  // The starting background is a global, not a parameter.
+  initialGlobals: {
+    backgrounds: { value: 'dark' },
+  },
   parameters: {
     backgrounds: {
-      default: 'dark',
-      values: [
-        { name: 'dark', value: '#171717' },
-        { name: 'surface', value: '#1c1c1c' },
-        { name: 'light', value: '#fafafa' },
-      ],
+      options: {
+        dark: { name: 'dark', value: '#171717' },
+        surface: { name: 'surface', value: '#1c1c1c' },
+        light: { name: 'light', value: '#fafafa' },
+      },
     },
     controls: {
       matchers: {
@@ -12095,7 +12118,7 @@ Button.displayName = 'Button';
 
 export { Button, buttonVariants };
 `;
-	const buttonStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const buttonStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Button } from '~/components/ui/button';
 
 const meta: Meta<typeof Button> = {
@@ -12260,7 +12283,7 @@ CardFooter.displayName = 'CardFooter';
 
 export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };
 `;
-	const inputStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const inputStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Input } from '~/components/ui/input';
 
 const meta: Meta<typeof Input> = {
@@ -12314,7 +12337,7 @@ export const WithValue: Story = {
   },
 };
 `;
-	const cardStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const cardStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Button } from '~/components/ui/button';
 import {
   Card,
@@ -12401,7 +12424,7 @@ Label.displayName = LabelPrimitive.Root.displayName;
 
 export { Label };
 `;
-	const labelStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const labelStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Input } from '~/components/ui/input';
 import { Label } from '~/components/ui/label';
 
@@ -12477,7 +12500,7 @@ function Badge({ className, variant, ...props }: BadgeProps) {
 
 export { Badge, badgeVariants };
 `;
-	const badgeStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const badgeStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Badge } from '~/components/ui/badge';
 
 const meta: Meta<typeof Badge> = {
@@ -12553,7 +12576,7 @@ Separator.displayName = SeparatorPrimitive.Root.displayName;
 
 export { Separator };
 `;
-	const separatorStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const separatorStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Separator } from '~/components/ui/separator';
 
 const meta: Meta<typeof Separator> = {
@@ -12658,7 +12681,7 @@ TabsContent.displayName = TabsPrimitive.Content.displayName;
 
 export { Tabs, TabsList, TabsTrigger, TabsContent };
 `;
-	const tabsStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const tabsStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
 import { Button } from '~/components/ui/button';
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from '~/components/ui/card';
@@ -12762,7 +12785,7 @@ TooltipContent.displayName = TooltipPrimitive.Content.displayName;
 
 export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };
 `;
-	const tooltipStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const tooltipStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '~/components/ui/tooltip';
 import { Button } from '~/components/ui/button';
 
@@ -12955,7 +12978,7 @@ export {
   DialogDescription,
 };
 `;
-	const dialogStories = `import type { Meta, StoryObj } from '@storybook/react';
+	const dialogStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
 import {
   Dialog,
   DialogContent,
@@ -13287,7 +13310,6 @@ export default nextConfig;
 			jsx: "preserve",
 			incremental: true,
 			plugins: [{ name: "next" }],
-			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*", "../../packages/ui/src/*"],
 				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi/api.ts"],
@@ -13582,8 +13604,7 @@ function generateTanStackWebFiles(options) {
 			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
 			tsx: TOOLCHAIN_VERSIONS["tsx"],
 			typescript: TOOLCHAIN_VERSIONS["typescript"],
-			vite: TOOLCHAIN_VERSIONS["vite"],
-			"vite-tsconfig-paths": DEPENDENCY_VERSIONS["vite-tsconfig-paths"]
+			vite: TOOLCHAIN_VERSIONS["vite"]
 		}
 	};
 	const viteConfig = `import { Credentials } from '@geekmidas/envkit/credentials';
@@ -13591,16 +13612,16 @@ import tailwindcss from '@tailwindcss/vite';
 import { tanstackStart } from '@tanstack/react-start/plugin/vite';
 import viteReact from '@vitejs/plugin-react';
 import { defineConfig } from 'vite';
-import tsconfigPaths from 'vite-tsconfig-paths';
 
 export default defineConfig({
+  // Vite resolves tsconfig \`paths\` itself; no plugin needed.
+  resolve: { tsconfigPaths: true },
   server: {
     port: Number(Credentials.PORT ?? 3001),
   },
   // VITE_* vars are inlined automatically; no manual loadEnv needed.
   envPrefix: 'VITE_',
   plugins: [
-    tsconfigPaths({ root: import.meta.dirname }),
     tailwindcss(),
     tanstackStart(),
     viteReact(),
@@ -13627,7 +13648,6 @@ export default defineConfig({
 			isolatedModules: true,
 			jsx: "preserve",
 			incremental: true,
-			baseUrl: ".",
 			types: ["vite/client"],
 			paths: {
 				"~/*": ["./src/*", "../../packages/ui/src/*"],
@@ -14890,7 +14910,7 @@ async function reconcileLocal(workspace, stage, options) {
 /**
 * Resolve secrets with priority:
 * 1. Local secrets exist → use them (preserves manual additions)
-* 2. SSM configured and has secrets → pull and use
+* 2. A deployed stage whose store has secrets → pull and use
 * 3. Neither → generate fresh secrets
 *
 * --force skips checks 1 and 2 and always regenerates.
@@ -14909,18 +14929,15 @@ async function resolveSecrets(stage, workspace, options) {
 			return reconciled ?? secrets;
 		}
 	}
-	if (isSSMConfigured(workspace)) {
-		logger$1.log("☁️  Checking for remote secrets in SSM...");
+	if (isRemoteStore(workspace, stage)) {
+		logger$1.log("☁️  Checking the secrets store...");
 		try {
-			const remoteSecrets = await pullSecrets(stage, workspace);
-			if (remoteSecrets) {
-				logger$1.log("✅ Pulled secrets from SSM");
-				await writeStageSecrets(remoteSecrets, workspace.root);
-				return remoteSecrets;
-			}
-			logger$1.log("   No remote secrets found");
+			const { secrets } = await pullStageSecrets(workspace, stage);
+			logger$1.log("✅ Pulled secrets from the store");
+			return secrets;
 		} catch (error) {
-			logger$1.warn(`⚠️  Failed to pull from SSM: ${error.message}`);
+			if (error instanceof NoStoredSecrets) logger$1.log("   The store holds none yet");
+			else logger$1.warn(`⚠️  Could not pull from the store: ${error.message}`);
 		}
 	}
 	logger$1.log("🔐 Generating fresh development secrets...");
@@ -15054,18 +15071,18 @@ async function generateFreshSecrets(stage, workspace, options) {
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await derivedContainers(workspace, stage));
 	await writeStageSecrets(secrets, workspace.root);
 	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (isSSMConfigured(workspace) && !options.yes) {
+	if (isRemoteStore(workspace, stage) && !options.yes) {
 		const { shouldPush } = await prompts({
 			type: "confirm",
 			name: "shouldPush",
-			message: "Push secrets to SSM for team sharing?",
+			message: `Push the "${stage}" secrets to its store?`,
 			initial: true
 		});
 		if (shouldPush) try {
-			await pushSecrets(stage, workspace);
-			logger$1.log("☁️  Secrets pushed to SSM");
+			await pushStageSecrets(workspace, stage);
+			logger$1.log("☁️  Secrets pushed to the store");
 		} catch (error) {
-			logger$1.warn(`⚠️  Failed to push to SSM: ${error.message}`);
+			logger$1.warn(`⚠️  Could not push to the store: ${error.message}`);
 		}
 	}
 	return secrets;
@@ -15499,7 +15516,7 @@ const program = new Command();
 program.name("gkm").description("GeekMidas backend framework CLI").version(version).option("--cwd <path>", "Change working directory").option("--debug", "Enable debug mode (verbose errors with stack traces)").hook("preAction", () => {
 	if (program.opts().debug);
 });
-program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").action(async (name, options) => {
+program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").action(async (name, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15716,54 +15733,30 @@ program.command("secrets:import").description("Import secrets from a JSON file")
 		process.exit(1);
 	}
 });
-program.command("secrets:push").description("Push secrets to remote provider (SSM)").requiredOption("--stage <stage>", "Stage name").action(async (options) => {
+program.command("secrets:push").description("Send a deployed stage's secrets to its store (secrets.store)").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushSecrets } = await import("./sync-B3xxXtJT.mjs").then((n) => n.i);
-		const { reconcileMissingSecrets } = await import("./reconcile-DhQ00DpU.mjs");
-		const { readStageSecrets, writeStageSecrets } = await import("./storage-P_b3w7uj.mjs").then((n) => n.a);
+		const { pushStageSecrets } = await import("./transfer-4A4S2hcw.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
-		const secrets = await readStageSecrets(options.stage, workspace.root);
-		if (secrets) {
-			const { derivedContainers } = await import("./credentials-BekkKtY_.mjs").then((n) => n.h);
-			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, options.stage));
-			if (result) {
-				await writeStageSecrets(result.secrets, workspace.root);
-				console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
-				for (const key of result.addedKeys) console.log(`    + ${key}`);
-			}
-		}
-		await pushSecrets(options.stage, workspace);
+		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
+		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
 		console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
-program.command("secrets:pull").description("Pull secrets from remote provider (SSM)").requiredOption("--stage <stage>", "Stage name").action(async (options) => {
+program.command("secrets:pull").description("Bring a deployed stage's secrets from its store into the local copy").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullSecrets } = await import("./sync-B3xxXtJT.mjs").then((n) => n.i);
-		const { writeStageSecrets } = await import("./storage-P_b3w7uj.mjs").then((n) => n.a);
-		const { reconcileMissingSecrets } = await import("./reconcile-DhQ00DpU.mjs");
+		const { pullStageSecrets } = await import("./transfer-4A4S2hcw.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
-		let secrets = await pullSecrets(options.stage, workspace);
-		if (!secrets) {
-			console.error(`No remote secrets found for stage "${options.stage}".`);
-			process.exit(1);
-		}
-		const { derivedContainers } = await import("./credentials-BekkKtY_.mjs").then((n) => n.h);
-		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, options.stage));
-		if (result) {
-			secrets = result.secrets;
-			console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
-			for (const key of result.addedKeys) console.log(`    + ${key}`);
-		}
-		await writeStageSecrets(secrets, workspace.root);
+		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
+		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
 		console.log(`\n✓ Secrets pulled for stage "${options.stage}"`);
 	} catch (error) {
 		console.error(formatError(error));
@@ -15775,8 +15768,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DhQ00DpU.mjs");
-		const { readStageSecrets, writeStageSecrets } = await import("./storage-P_b3w7uj.mjs").then((n) => n.a);
+		const { reconcileMissingSecrets } = await import("./reconcile-fmoluZmZ.mjs").then((n) => n.n);
+		const { readStageSecrets, writeStageSecrets } = await import("./storage-TP0x118M.mjs").then((n) => n.a);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets(stage, workspace.root);
@@ -15784,7 +15777,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./credentials-BekkKtY_.mjs").then((n) => n.h);
+		const { derivedContainers } = await import("./credentials-fJP5-fa1.mjs").then((n) => n.h);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -15843,7 +15836,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-CRwnxKmD.mjs");
+		const { deployGithubCommand } = await import("./github-CAfKyYPN.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));