@geekmidas/cli 10.0.0-alpha.25 → 10.0.0-alpha.27

package/dist/{credentials-Dbyccl3A.cjs → workspace-DgeVgxmm.cjs}

@@ -1,8 +1,7 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-B_HtYJCr.cjs");
-const require_config = require("./config-Dn9DW2Fz.cjs");
-const require_workspace = require("./workspace-CRD9YinV.cjs");
-const require_generator = require("./generator-Wdfp0jCS.cjs");
+const require_config = require("./config-7R_-WyHq.cjs");
+const require_workspace = require("./workspace-Bav3TVrP.cjs");
 const require_storage = require("./storage-DgypfSD6.cjs");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -11,13 +10,233 @@ let node_child_process = require("node:child_process");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_net = require("node:net");
 let dotenv = require("dotenv");
-let yaml = require("yaml");
 let node_crypto = require("node:crypto");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let pg = require("pg");
+let yaml = require("yaml");
 let node_util = require("node:util");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
+//#region src/credentials/index.ts
+const logger = console;
+/**
+* Load environment files
+* @internal Exported for testing
+*/
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = (0, node_path.resolve)(cwd, envFile);
+		if ((0, node_fs.existsSync)(envPath)) {
+			(0, dotenv.config)({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
+/**
+* Check if a port is available
+* @internal Exported for testing
+*/
+async function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = (0, node_net.createServer)();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve(false);
+			else resolve(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve(true);
+		});
+		server.listen(port);
+	});
+}
+/**
+* Find an available port starting from the preferred port
+* @internal Exported for testing
+*/
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+	}
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+}
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
+*/
+async function loadSecretsForApp(secretsRoot, stage, appName) {
+	let secrets = {};
+	if (require_storage.secretsExist(stage, secretsRoot)) {
+		const stageSecrets = await require_storage.readStageSecrets(stage, secretsRoot);
+		if (stageSecrets) {
+			logger.log(`🔐 Loading secrets from stage: ${stage}`);
+			secrets = require_storage.toEmbeddableSecrets(stageSecrets);
+		}
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
+}
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if ((0, node_fs.existsSync)((0, node_path.join)(dir, ".gkm", "secrets"))) return dir;
+		const parent = (0, node_path.dirname)(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
+}
+/**
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
+*/
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
+}
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await (0, node_fs_promises.writeFile)(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await (0, node_fs_promises.writeFile)(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	let workspace;
+	try {
+		appInfo = await require_config.loadWorkspaceAppInfo(cwd);
+		workspace = appInfo.workspace;
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch {
+		workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
+		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const stage = options.stage ?? workspace?.stages.local;
+	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
+	credentials.PORT = String(resolvedPort);
+	const declaredKeys = [];
+	if (workspace) {
+		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
+		const reconciled = await reconcileWorkspace(workspace, {
+			stage: options.reconcileStage ?? workspace.stages.local,
+			start: options.startDocker ?? false
+		});
+		Object.assign(credentials, reconciled.env);
+		declaredKeys.push(...Object.keys(reconciled.env));
+		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+	}
+	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
+	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo,
+		declaredKeys
+	};
+}
+//#endregion
 //#region src/workspace/backends.ts
 /**
 * Which backend each declared kind resolves to — decided by where the project
@@ -2235,8 +2454,7 @@ var workspace_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	reconcileWorkspace: () => reconcileWorkspace,
-	surfaceAddresses: () => surfaceAddresses,
-	usesConstructs: () => usesConstructs
+	surfaceAddresses: () => surfaceAddresses
 });
 /**
 * Every constructs glob in the workspace, resolved against its app.
@@ -2247,10 +2465,6 @@ var workspace_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 function constructGlobs(workspace) {
 	return require_workspace.allConstructGlobs(workspace);
 }
-/** Whether any app has adopted the constructs glob. */
-function usesConstructs(workspace) {
-	return constructGlobs(workspace).length > 0;
-}
 /** The backends a workspace's target implies, as the plan takes them. */
 function backendsOf(workspace) {
 	const on = providerOf(workspace);
@@ -2336,488 +2550,10 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/credentials/index.ts
-const logger = console;
-/**
-* Load environment files
-* @internal Exported for testing
-*/
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = (0, node_path.resolve)(cwd, envFile);
-		if ((0, node_fs.existsSync)(envPath)) {
-			(0, dotenv.config)({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
-}
-/**
-* Check if a port is available
-* @internal Exported for testing
-*/
-async function isPortAvailable(port) {
-	return new Promise((resolve) => {
-		const server = (0, node_net.createServer)();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve(false);
-			else resolve(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve(true);
-		});
-		server.listen(port);
-	});
-}
-/**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
-*/
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
-	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
-}
-const PORT_STATE_PATH = ".gkm/ports.json";
-/**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
-*/
-function parseComposePortMappings(composePath) {
-	if (!(0, node_fs.existsSync)(composePath)) return [];
-	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
-	const compose = (0, yaml.parse)(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
-}
-/**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function loadPortState(workspaceRoot) {
-	try {
-		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-/**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function savePortState(workspaceRoot, ports) {
-	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
-/**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
-*/
-function getContainerHostPort(workspaceRoot, service, containerPort) {
-	try {
-		const match = (0, node_child_process.execSync)(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim().match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function resolveServicePorts(workspaceRoot) {
-	const mappings = parseComposePortMappings((0, node_path.join)(workspaceRoot, "docker-compose.yml"));
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
-	}
-	await savePortState(workspaceRoot, ports);
-	return {
-		dockerEnv,
-		ports,
-		mappings
-	};
-}
-/**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
-*/
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
-}
-/**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
-*/
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
-	}
-	return result;
-}
-/**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
-*/
-function buildDockerComposeEnv(secretsEnv, portEnv) {
-	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
-	};
-}
-/**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
-*/
-function parseComposeServiceNames(composePath) {
-	if (!(0, node_fs.existsSync)(composePath)) return [];
-	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
-	const compose = (0, yaml.parse)(content);
-	return Object.keys(compose?.services ?? {});
-}
-/**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
-*/
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = (0, node_path.join)(cwd, "docker-compose.yml");
-	if (!(0, node_fs.existsSync)(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
-*/
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
-	if (!(0, node_fs.existsSync)(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name) => !appNames.has(name));
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
-*/
-async function loadSecretsForApp(secretsRoot, stage, appName) {
-	let secrets = {};
-	if (require_storage.secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await require_storage.readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = require_storage.toEmbeddableSecrets(stageSecrets);
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
-}
-/**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
-*/
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if ((0, node_fs.existsSync)((0, node_path.join)(dir, ".gkm", "secrets"))) return dir;
-		const parent = (0, node_path.dirname)(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
-/**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
-*/
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
-}
-`;
-}
-/**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
-*/
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await (0, node_fs_promises.writeFile)(preloadPath, content);
-}
-/**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
-*/
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await (0, node_fs_promises.writeFile)(wrapperPath, content);
-}
-/**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
-*
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
-*/
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	let workspace;
-	try {
-		appInfo = await require_config.loadWorkspaceAppInfo(cwd);
-		workspace = appInfo.workspace;
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
-		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const stage = options.stage ?? workspace?.stages.local;
-	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
-	credentials.PORT = String(resolvedPort);
-	const declaredKeys = [];
-	if (workspace && usesConstructs(workspace)) {
-		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
-		const reconciled = await reconcileWorkspace(workspace, {
-			stage: options.reconcileStage ?? workspace.stages.local,
-			start: options.startDocker ?? false
-		});
-		Object.assign(credentials, reconciled.env);
-		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
-	} else {
-		const mappings = parseComposePortMappings((0, node_path.join)(secretsRoot, "docker-compose.yml"));
-		if (mappings.length > 0) {
-			let resolvedPorts;
-			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-			else {
-				const savedPorts = await loadPortState(secretsRoot);
-				const ports = {};
-				for (const mapping of mappings) {
-					const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-					if (containerPort !== null) ports[mapping.envVar] = containerPort;
-					else {
-						const saved = savedPorts[mapping.envVar];
-						if (saved !== void 0) ports[mapping.envVar] = saved;
-					}
-				}
-				resolvedPorts = {
-					dockerEnv: {},
-					ports,
-					mappings
-				};
-			}
-			if (options.startDocker) {
-				if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-				else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-			}
-			if (Object.keys(resolvedPorts.ports).length > 0) {
-				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-				Object.assign(credentials, rewritten);
-				logger.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-			}
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		Object.assign(credentials, depEnv);
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = require_generator.generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
-	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
-	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo,
-		declaredKeys
-	};
-}
-//#endregion
-Object.defineProperty(exports, "COMPOSE_PATH", {
-	enumerable: true,
-	get: function() {
-		return COMPOSE_PATH;
+Object.defineProperty(exports, "COMPOSE_PATH", {
+	enumerable: true,
+	get: function() {
+		return COMPOSE_PATH;
 	}
 });
 Object.defineProperty(exports, "LOCAL_CA_PATH", {
@@ -2916,42 +2652,18 @@ Object.defineProperty(exports, "reconcileWorkspace", {
 		return reconcileWorkspace;
 	}
 });
-Object.defineProperty(exports, "resolveServicePorts", {
-	enumerable: true,
-	get: function() {
-		return resolveServicePorts;
-	}
-});
 Object.defineProperty(exports, "resourceName", {
 	enumerable: true,
 	get: function() {
 		return resourceName;
 	}
 });
-Object.defineProperty(exports, "rewriteUrlsWithPorts", {
-	enumerable: true,
-	get: function() {
-		return rewriteUrlsWithPorts;
-	}
-});
-Object.defineProperty(exports, "startWorkspaceServices", {
-	enumerable: true,
-	get: function() {
-		return startWorkspaceServices;
-	}
-});
 Object.defineProperty(exports, "storageBackendFor", {
 	enumerable: true,
 	get: function() {
 		return storageBackendFor;
 	}
 });
-Object.defineProperty(exports, "usesConstructs", {
-	enumerable: true,
-	get: function() {
-		return usesConstructs;
-	}
-});
 Object.defineProperty(exports, "workspace_exports", {
 	enumerable: true,
 	get: function() {
@@ -2959,4 +2671,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=credentials-Dbyccl3A.cjs.map
+//# sourceMappingURL=workspace-DgeVgxmm.cjs.map