@geekmidas/cli 10.0.0-alpha.25 → 10.0.0-alpha.27

package/dist/{credentials-BpoOUa74.mjs → workspace-CUmR_k4J.mjs}

@@ -1,23 +1,242 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as DEFAULT_EVENTS$1, i as DEFAULT_CACHE, o as DEFAULT_STORAGE, t as discover } from "./discover-0fhCbnk0.mjs";
-import { a as loadWorkspaceAppInfo, c as appKey, n as getAppNameFromCwd, o as loadWorkspaceConfig } from "./config-DBGpRTUy.mjs";
-import { s as getDependencyEnvVars, t as allConstructGlobs, w as TEST_STAGE } from "./workspace-Bu3xNCej.mjs";
-import { r as generatePgBossUrl } from "./generator-LfZU7NlU.mjs";
+import { l as appKey, o as loadWorkspaceAppInfo, r as getAppNameFromCwd, s as loadWorkspaceConfig } from "./config-DXrrYvob.mjs";
+import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-T4IVGSoB.mjs";
 import { n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist } from "./storage-TP0x118M.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { execFile, execSync } from "node:child_process";
+import { execFile } from "node:child_process";
 import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { config } from "dotenv";
-import { parse as parse$1, stringify } from "yaml";
 import { createHash } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { Client } from "pg";
+import { stringify } from "yaml";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
+//#region src/credentials/index.ts
+const logger = console;
+/**
+* Load environment files
+* @internal Exported for testing
+*/
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = resolve(cwd, envFile);
+		if (existsSync(envPath)) {
+			config({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
+/**
+* Check if a port is available
+* @internal Exported for testing
+*/
+async function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve(false);
+			else resolve(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve(true);
+		});
+		server.listen(port);
+	});
+}
+/**
+* Find an available port starting from the preferred port
+* @internal Exported for testing
+*/
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+	}
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+}
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = join(workspaceRoot, ".gkm");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
+*/
+async function loadSecretsForApp(secretsRoot, stage, appName) {
+	let secrets = {};
+	if (secretsExist(stage, secretsRoot)) {
+		const stageSecrets = await readStageSecrets(stage, secretsRoot);
+		if (stageSecrets) {
+			logger.log(`🔐 Loading secrets from stage: ${stage}`);
+			secrets = toEmbeddableSecrets(stageSecrets);
+		}
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
+}
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
+}
+/**
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
+*/
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
+}
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await writeFile(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await writeFile(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	let workspace;
+	try {
+		appInfo = await loadWorkspaceAppInfo(cwd);
+		workspace = appInfo.workspace;
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch {
+		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
+		appName = getAppNameFromCwd(cwd) ?? void 0;
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const stage = options.stage ?? workspace?.stages.local;
+	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
+	credentials.PORT = String(resolvedPort);
+	const declaredKeys = [];
+	if (workspace) {
+		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
+		const reconciled = await reconcileWorkspace(workspace, {
+			stage: options.reconcileStage ?? workspace.stages.local,
+			start: options.startDocker ?? false
+		});
+		Object.assign(credentials, reconciled.env);
+		declaredKeys.push(...Object.keys(reconciled.env));
+		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+	}
+	const secretsDir = join(secretsRoot, ".gkm");
+	await mkdir(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = join(secretsDir, secretsFileName);
+	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo,
+		declaredKeys
+	};
+}
+//#endregion
 //#region src/workspace/backends.ts
 /**
 * Which backend each declared kind resolves to — decided by where the project
@@ -2235,8 +2454,7 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	reconcileWorkspace: () => reconcileWorkspace,
-	surfaceAddresses: () => surfaceAddresses,
-	usesConstructs: () => usesConstructs
+	surfaceAddresses: () => surfaceAddresses
 });
 /**
 * Every constructs glob in the workspace, resolved against its app.
@@ -2247,10 +2465,6 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 function constructGlobs(workspace) {
 	return allConstructGlobs(workspace);
 }
-/** Whether any app has adopted the constructs glob. */
-function usesConstructs(workspace) {
-	return constructGlobs(workspace).length > 0;
-}
 /** The backends a workspace's target implies, as the plan takes them. */
 function backendsOf(workspace) {
 	const on = providerOf(workspace);
@@ -2336,484 +2550,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/credentials/index.ts
-const logger = console;
-/**
-* Load environment files
-* @internal Exported for testing
-*/
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = resolve(cwd, envFile);
-		if (existsSync(envPath)) {
-			config({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
-}
-/**
-* Check if a port is available
-* @internal Exported for testing
-*/
-async function isPortAvailable(port) {
-	return new Promise((resolve) => {
-		const server = createServer();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve(false);
-			else resolve(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve(true);
-		});
-		server.listen(port);
-	});
-}
-/**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
-*/
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
-	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
-}
-const PORT_STATE_PATH = ".gkm/ports.json";
-/**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
-*/
-function parseComposePortMappings(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
-}
-/**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function loadPortState(workspaceRoot) {
-	try {
-		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-/**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function savePortState(workspaceRoot, ports) {
-	const dir = join(workspaceRoot, ".gkm");
-	await mkdir(dir, { recursive: true });
-	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
-/**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
-*/
-function getContainerHostPort(workspaceRoot, service, containerPort) {
-	try {
-		const match = execSync(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim().match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function resolveServicePorts(workspaceRoot) {
-	const mappings = parseComposePortMappings(join(workspaceRoot, "docker-compose.yml"));
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
-	}
-	await savePortState(workspaceRoot, ports);
-	return {
-		dockerEnv,
-		ports,
-		mappings
-	};
-}
-/**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
-*/
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
-}
-/**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
-*/
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
-	}
-	return result;
-}
-/**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
-*/
-function buildDockerComposeEnv(secretsEnv, portEnv) {
-	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
-	};
-}
-/**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
-*/
-function parseComposeServiceNames(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	return Object.keys(compose?.services ?? {});
-}
-/**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
-*/
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = join(cwd, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
-*/
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = join(workspace.root, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name) => !appNames.has(name));
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
-*/
-async function loadSecretsForApp(secretsRoot, stage, appName) {
-	let secrets = {};
-	if (secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = toEmbeddableSecrets(stageSecrets);
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
-}
-/**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
-*/
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
-/**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
-*/
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
-}
-`;
-}
-/**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
-*/
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await writeFile(preloadPath, content);
-}
-/**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
-*/
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await writeFile(wrapperPath, content);
-}
-/**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
-*
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
-*/
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	let workspace;
-	try {
-		appInfo = await loadWorkspaceAppInfo(cwd);
-		workspace = appInfo.workspace;
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
-		appName = getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const stage = options.stage ?? workspace?.stages.local;
-	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
-	credentials.PORT = String(resolvedPort);
-	const declaredKeys = [];
-	if (workspace && usesConstructs(workspace)) {
-		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
-		const reconciled = await reconcileWorkspace(workspace, {
-			stage: options.reconcileStage ?? workspace.stages.local,
-			start: options.startDocker ?? false
-		});
-		Object.assign(credentials, reconciled.env);
-		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
-	} else {
-		const mappings = parseComposePortMappings(join(secretsRoot, "docker-compose.yml"));
-		if (mappings.length > 0) {
-			let resolvedPorts;
-			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-			else {
-				const savedPorts = await loadPortState(secretsRoot);
-				const ports = {};
-				for (const mapping of mappings) {
-					const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-					if (containerPort !== null) ports[mapping.envVar] = containerPort;
-					else {
-						const saved = savedPorts[mapping.envVar];
-						if (saved !== void 0) ports[mapping.envVar] = saved;
-					}
-				}
-				resolvedPorts = {
-					dockerEnv: {},
-					ports,
-					mappings
-				};
-			}
-			if (options.startDocker) {
-				if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-				else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-			}
-			if (Object.keys(resolvedPorts.ports).length > 0) {
-				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-				Object.assign(credentials, rewritten);
-				logger.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-			}
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		Object.assign(credentials, depEnv);
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
-	const secretsDir = join(secretsRoot, ".gkm");
-	await mkdir(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = join(secretsDir, secretsFileName);
-	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo,
-		declaredKeys
-	};
-}
-//#endregion
-export { providerOf as C, eventsBackendFor as S, COMPOSE_PATH as _, loadEnvFiles as a, resourceName as b, resolveServicePorts as c, backendsOf as d, constructGlobs as f, workspace_exports as g, usesConstructs as h, isPortAvailable as i, rewriteUrlsWithPorts as l, reconcileWorkspace as m, createEntryWrapper as n, loadSecretsForApp as o, derivedContainers as p, findAvailablePort as r, prepareEntryCredentials as s, createCredentialsPreload as t, startWorkspaceServices as u, LOCAL_CA_PATH as v, storageBackendFor as w, cacheBackendFor as x, applyPostgres as y };
+export { isPortAvailable as _, workspace_exports as a, prepareEntryCredentials as b, applyPostgres as c, eventsBackendFor as d, providerOf as f, findAvailablePort as g, createEntryWrapper as h, reconcileWorkspace as i, resourceName as l, createCredentialsPreload as m, constructGlobs as n, COMPOSE_PATH as o, storageBackendFor as p, derivedContainers as r, LOCAL_CA_PATH as s, backendsOf as t, cacheBackendFor as u, loadEnvFiles as v, loadSecretsForApp as y };
 
-//# sourceMappingURL=credentials-BpoOUa74.mjs.map
+//# sourceMappingURL=workspace-CUmR_k4J.mjs.map