@geekmidas/cli 10.0.0-alpha.25 → 10.0.0-alpha.27

package/dist/index.cjs

@@ -2,15 +2,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-B_HtYJCr.cjs");
-const require_config = require("./config-Dn9DW2Fz.cjs");
-const require_workspace = require("./workspace-CRD9YinV.cjs");
-const require_credentials = require("./credentials-Dbyccl3A.cjs");
-const require_generator = require("./generator-Wdfp0jCS.cjs");
+const require_config = require("./config-7R_-WyHq.cjs");
+const require_workspace = require("./workspace-Bav3TVrP.cjs");
 const require_storage = require("./storage-DgypfSD6.cjs");
-const require_openapi = require("./openapi-BAKQLho-.cjs");
+const require_workspace$1 = require("./workspace-DgeVgxmm.cjs");
+const require_openapi = require("./openapi-rhJdy2GC.cjs");
 const require_emit = require("./emit-BdoPFjZf.cjs");
-const require_reconcile = require("./reconcile-hx_vBvux.cjs");
-const require_transfer = require("./transfer-D59M4aaR.cjs");
+const require_reconcile = require("./reconcile-szmJw_Sb.cjs");
+const require_transfer = require("./transfer-BYIn7z8m.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
 let node_readline_promises = require("node:readline/promises");
@@ -25,13 +24,13 @@ let fast_glob = require("fast-glob");
 fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
 let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
-let yaml = require("yaml");
 let node_crypto = require("node:crypto");
+let node_url = require("node:url");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
+let yaml = require("yaml");
 let node_util = require("node:util");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
-let node_url = require("node:url");
 let _geekmidas_constructs_crons = require("@geekmidas/constructs/crons");
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
@@ -44,7 +43,7 @@ prompts = require_rolldown_runtime.__toESM(prompts, 1);
 let _geekmidas_envkit = require("@geekmidas/envkit");
 let _geekmidas_services = require("@geekmidas/services");
 //#region package.json
-var version = "10.0.0-alpha.25";
+var version = "10.0.0-alpha.27";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -434,19 +433,16 @@ var NoCommandSpecified = class extends Error {
 async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
-	const defaultEnv = require_credentials.loadEnvFiles(".env");
+	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await require_credentials.prepareEntryCredentials({
-		cwd,
-		resolveDockerPorts: "readonly"
-	});
+	const { credentials, secretsJsonPath, appName } = await require_workspace$1.prepareEntryCredentials({ cwd });
 	if (appName) logger$12.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
 	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
-	await require_credentials.createCredentialsPreload(preloadPath, secretsJsonPath);
+	await require_workspace$1.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
 	logger$12.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
@@ -563,7 +559,7 @@ function getProductionConfigFromGkm(config) {
 }
 async function devCommand(options) {
 	if (options.entry) return entryDevCommand(options);
-	const defaultEnv = require_credentials.loadEnvFiles(".env");
+	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appName = require_config.getAppNameFromCwd();
 	let config;
@@ -597,6 +593,7 @@ async function devCommand(options) {
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config = loadedConfig.raw;
+		workspace = loadedConfig.workspace;
 	}
 	else {
 		const loadedConfig = await require_config.loadWorkspaceConfig();
@@ -608,7 +605,7 @@ async function devCommand(options) {
 		workspace = loadedConfig.workspace;
 	}
 	if (config.env) {
-		const { loaded, missing } = require_credentials.loadEnvFiles(config.env, appRoot);
+		const { loaded, missing } = require_workspace$1.loadEnvFiles(config.env, appRoot);
 		if (loaded.length > 0) logger$11.log(`📦 Loaded env: ${loaded.join(", ")}`);
 		if (missing.length > 0) logger$11.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
@@ -629,7 +626,7 @@ async function devCommand(options) {
 		appRoot,
 		providers: ["server"],
 		enableOpenApi,
-		cacheBackend: require_credentials.cacheBackendFor(require_credentials.providerOf(workspace ?? config)),
+		cacheBackend: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace ?? config)),
 		telescope,
 		studio,
 		hooks,
@@ -640,25 +637,14 @@ async function devCommand(options) {
 	const initial = await build();
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
-	const appSecrets = await require_credentials.loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
-	if (workspace && require_credentials.usesConstructs(workspace)) {
-		const reconciled = await require_credentials.reconcileWorkspace(workspace, { stage: workspace.stages.local });
+	const appSecrets = await require_workspace$1.loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
+	if (workspace) {
+		const reconciled = await require_workspace$1.reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
 		}
 		Object.assign(appSecrets, reconciled.env);
-	} else {
-		const resolvedPorts = await require_credentials.resolveServicePorts(secretsRoot);
-		if (Object.keys(resolvedPorts.ports).length > 0) {
-			const rewritten = require_credentials.rewriteUrlsWithPorts(appSecrets, resolvedPorts);
-			Object.assign(appSecrets, rewritten);
-			logger$11.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-		}
-	}
-	if (workspace && workspaceAppName) {
-		const depEnv = require_workspace.getDependencyEnvVars(workspace, workspaceAppName);
-		Object.assign(appSecrets, depEnv);
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
@@ -668,7 +654,7 @@ async function devCommand(options) {
 		await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
 		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
 	}
-	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? false, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
+	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
 	await devServer.start();
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
 	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
@@ -727,19 +713,6 @@ async function devCommand(options) {
 	process.on("SIGTERM", shutdown);
 }
 /**
-* Generate all dependency environment variables for all apps.
-* Returns a flat object with all {APP_NAME}_URL variables.
-* @internal Exported for testing
-*/
-function generateAllDependencyEnvVars(workspace, urlPrefix = "http://localhost") {
-	const env = {};
-	for (const appName of Object.keys(workspace.apps)) {
-		const appEnv = require_workspace.getDependencyEnvVars(workspace, appName, urlPrefix);
-		Object.assign(env, appEnv);
-	}
-	return env;
-}
-/**
 * Check for port conflicts across all apps.
 * Returns list of conflicts if any ports are duplicated.
 * @internal Exported for testing
@@ -964,27 +937,25 @@ async function workspaceDevCommand(workspace, options) {
 		logger$11.log("✅ Frontend apps validated");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	let secretsEnv;
-	if (require_credentials.usesConstructs(workspace)) {
-		const reconciled = await require_credentials.reconcileWorkspace(workspace, { stage: workspace.stages.local });
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
-		}
-		secretsEnv = {
-			...rawSecrets,
-			...reconciled.env
-		};
-	} else {
-		const resolvedPorts = await require_credentials.resolveServicePorts(workspace.root);
-		await require_credentials.startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
-		secretsEnv = require_credentials.rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
+	const reconciled = await require_workspace$1.reconcileWorkspace(workspace, { stage: workspace.stages.local });
+	if (reconciled.changed && reconciled.plan.containers.length > 0) {
+		logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
+		for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
+	}
+	const secretsEnv = {
+		...rawSecrets,
+		...reconciled.env
+	};
+	const appUrls = {};
+	for (const resource of reconciled.plan.resources) {
+		if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
+		const address = reconciled.env[resource.envKey];
+		if (address) appUrls[resource.id] = address;
 	}
 	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
-	const dependencyEnv = generateAllDependencyEnvVars(workspace);
-	if (Object.keys(dependencyEnv).length > 0) {
-		logger$11.log("📡 Dependency URLs:");
-		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
+	if (Object.keys(appUrls).length > 0) {
+		logger$11.log("🔒 App URLs:");
+		for (const [id, address] of Object.entries(appUrls)) logger$11.log(`   ${id}: ${address}`);
 	}
 	let turboFilter = [];
 	if (options.app) {
@@ -1028,10 +999,20 @@ async function workspaceDevCommand(workspace, options) {
 	const turboEnv = {
 		...process.env,
 		...secretsEnv,
-		...dependencyEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
 	};
+	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(workspace.apps);
+	const held = [];
+	for (const appName of scoped) {
+		const port = workspace.apps[appName]?.port;
+		if (port && !await require_workspace$1.isPortAvailable(port)) held.push({
+			app: appName,
+			port,
+			holder: listenerOn(port)
+		});
+	}
+	if (held.length > 0) throw new WorkspacePortsInUse(held);
 	logger$11.log("\n🏃 Starting turbo run dev...\n");
 	const turboProcess = (0, node_child_process.spawn)("pnpm", [
 		"turbo",
@@ -1090,16 +1071,16 @@ async function entryDevCommand(options) {
 	if (!entry) throw new Error("--entry requires a file path");
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
-	const defaultEnv = require_credentials.loadEnvFiles(".env");
+	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_credentials.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_workspace$1.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
 	if (appName) logger$11.log(`📦 App: ${appName} (port ${resolvedPort})`);
 	logger$11.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
 	if (Object.keys(credentials).length > 1) logger$11.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
-	await require_credentials.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
+	await require_workspace$1.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
 	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
 	await runner.start();
 	let isShuttingDown = false;
@@ -1209,6 +1190,19 @@ var EntryRunner = class {
 */
 function generateServerEntryContent(options) {
 	const { secretsJsonPath, runtime = "node", enableOpenApi = false, appImportPath = "./app.js", selfServing = false } = options;
+	const parentWatch = `// Exit when the gkm dev that started this server is gone.
+const __gkmDevPid = Number(process.env.GKM_DEV_PID);
+if (__gkmDevPid) {
+  setInterval(() => {
+    try {
+      process.kill(__gkmDevPid, 0);
+    } catch {
+      process.exit(0);
+    }
+  }, 1000).unref();
+}
+
+`;
 	const credentialsInjection = secretsJsonPath ? `import { existsSync, readFileSync } from 'node:fs';
 
 // Inject dev secrets via globalThis (must happen before app import)
@@ -1239,8 +1233,7 @@ if (existsSync(secretsPath)) {
  * Development server entry point for a surface that serves itself
  * This file is auto-generated by 'gkm dev'
  */
-${credentialsInjection}
-const port = process.argv.includes('--port')
+${credentialsInjection}${parentWatch}const port = process.argv.includes('--port')
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
@@ -1255,8 +1248,7 @@ console.log(\`Server started on port \${port}\`);
  * Development server entry point
  * This file is auto-generated by 'gkm dev'
  */
-${credentialsInjection}
-const port = process.argv.includes('--port')
+${credentialsInjection}${parentWatch}const port = process.argv.includes('--port')
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
@@ -1278,6 +1270,44 @@ start({
 });
 `;
 }
+/** A port this app must serve on is held by something else. */
+var DevPortInUse = class extends Error {
+	port;
+	holder;
+	constructor(port, holder) {
+		super(`Port ${port} is already in use${holder ? ` by ${holder}` : ""}. It is the port this app is provisioned on — the one every other app and its CORS origins point at — so dev will not move off it. Stop what is holding it (often a dev server a previous run left behind), or pass -p/--port to run this app somewhere else.`);
+		this.port = port;
+		this.holder = holder;
+		this.name = "DevPortInUse";
+	}
+};
+/** Apps whose provisioned ports are held before the workspace starts. */
+var WorkspacePortsInUse = class extends Error {
+	held;
+	constructor(held) {
+		super(`Ports this workspace's apps are provisioned on are already in use:\n${held.map(({ app, port, holder }) => `   ${app}: ${port}${holder ? ` — held by ${holder}` : ""}`).join("\n")}\nStop what is holding them (often dev servers a previous run left behind) and start again. Nothing was started.`);
+		this.held = held;
+		this.name = "WorkspacePortsInUse";
+	}
+};
+/** What is listening on a port, as `command (pid N)`, if `lsof` can tell. */
+function listenerOn(port) {
+	try {
+		const out = (0, node_child_process.execSync)(`lsof -nP -iTCP:${port} -sTCP:LISTEN -Fpc`, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		const pid = out.match(/^p(\d+)/m)?.[1];
+		const command = out.match(/^c(.+)$/m)?.[1];
+		return pid ? `${command ?? "a process"} (pid ${pid})` : void 0;
+	} catch {
+		return;
+	}
+}
 var DevServer = class {
 	provider;
 	requestedPort;
@@ -1310,10 +1340,10 @@ var DevServer = class {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
 		if (this.portExplicit) {
-			if (!await require_credentials.isPortAvailable(this.requestedPort)) throw new Error(`Port ${this.requestedPort} is already in use. Either stop the process using that port or omit -p/--port to auto-select an available port.`);
+			if (!await require_workspace$1.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
 			this.actualPort = this.requestedPort;
 		} else {
-			this.actualPort = await require_credentials.findAvailablePort(this.requestedPort);
+			this.actualPort = await require_workspace$1.findAvailablePort(this.requestedPort);
 			if (this.actualPort !== this.requestedPort) logger$11.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", this.provider, "server.ts");
@@ -1328,7 +1358,8 @@ var DevServer = class {
 			stdio: "inherit",
 			env: {
 				...process.env,
-				NODE_ENV: "development"
+				NODE_ENV: "development",
+				GKM_DEV_PID: String(process.pid)
 			},
 			detached: true
 		});
@@ -1385,7 +1416,7 @@ var DevServer = class {
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
-			if (await require_credentials.isPortAvailable(portToReuse)) break;
+			if (await require_workspace$1.isPortAvailable(portToReuse)) break;
 			await new Promise((resolve) => setTimeout(resolve, 100));
 			attempts++;
 		}
@@ -2561,7 +2592,7 @@ async function buildCommand(options) {
 	}
 	const config = loadedConfig.type !== "workspace" ? await require_config.loadConfig() : (0, node_path.resolve)(process.cwd()) === (0, node_path.resolve)(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await require_config.loadAppConfig()).gkmConfig;
 	const resolved = resolveProviders(config, options);
-	const cacheBackend = require_credentials.cacheBackendFor(require_credentials.providerOf(loadedConfig.workspace));
+	const cacheBackend = require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(loadedConfig.workspace));
 	const productionConfigFromGkm = getProductionConfigFromGkm(config);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
 	if (production) logger$9.log(`🏭 Building for PRODUCTION`);
@@ -2995,7 +3026,7 @@ const PROVISIONERS = {
 	*/
 	database: async (declaration, context) => {
 		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
-		const name = require_credentials.resourceName(declaration.id, declaration.kind, context.stage);
+		const name = require_workspace$1.resourceName(declaration.id, declaration.kind, context.stage);
 		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
 			stage: context.stage,
 			app: context.project
@@ -3031,7 +3062,7 @@ const PROVISIONERS = {
 		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
 		const parent = context.provisioned[declaration.of];
 		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const runtime = require_credentials.resourceName(declaration.id, declaration.kind, context.stage);
+		const runtime = require_workspace$1.resourceName(declaration.id, declaration.kind, context.stage);
 		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
 		const reads = readsFrom(context.manifest, declaration.id);
 		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
@@ -3133,7 +3164,7 @@ const PROVISIONERS = {
 			stage: context.stage,
 			app: context.project
 		}, declaration.id);
-		const bucket = require_credentials.resourceName(declaration.id, declaration.kind, context.stage);
+		const bucket = require_workspace$1.resourceName(declaration.id, declaration.kind, context.stage);
 		const user = `${bucket}-root`;
 		const password = derivedPassword(context, `objects:${declaration.id}`);
 		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
@@ -3501,10 +3532,6 @@ var UnprovisionableBucket = class extends Error {
 */
 /**
 * Provision everything the workspace declares, and return what it resolved.
-*
-* Nothing happens for a project that has not adopted the model: `usesConstructs`
-* is the same hard switch reconcile reads, so an existing deploy is untouched
-* until it declares something.
 */
 async function provisionDeclared(options) {
 	const { workspace } = options;
@@ -3514,9 +3541,8 @@ async function provisionDeclared(options) {
 		provisioned: {},
 		clusters: {}
 	};
-	if (!require_credentials.usesConstructs(workspace)) return empty;
 	const manifest = options.manifest ?? await require_discover.discover({
-		patterns: require_credentials.constructGlobs(workspace),
+		patterns: require_workspace$1.constructGlobs(workspace),
 		cwd: workspace.root
 	});
 	if (Object.keys(manifest).length === 0) return empty;
@@ -3528,9 +3554,9 @@ async function provisionDeclared(options) {
 		environmentId: options.environmentId,
 		stage: options.stage,
 		project: workspace.name,
-		cache: require_credentials.cacheBackendFor(require_credentials.providerOf(workspace)),
-		events: require_credentials.eventsBackendFor(require_credentials.providerOf(workspace)),
-		storage: require_credentials.storageBackendFor(require_credentials.providerOf(workspace)),
+		cache: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace)),
+		events: require_workspace$1.eventsBackendFor(require_workspace$1.providerOf(workspace)),
+		storage: require_workspace$1.storageBackendFor(require_workspace$1.providerOf(workspace)),
 		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
 		...options.secrets ? { secrets: options.secrets } : {},
 		deferred: [],
@@ -3567,7 +3593,7 @@ async function provisionDeclared(options) {
 * run again.
 */
 async function applyDeclared(client, statements) {
-	return (await require_credentials.applyPostgres(client, statements)).filter((entry) => entry.created).length;
+	return (await require_workspace$1.applyPostgres(client, statements)).filter((entry) => entry.created).length;
 }
 /**
 * The provisioning order, with queues and topics moved to the end.
@@ -5257,7 +5283,7 @@ async function workspaceDockerCommand(workspace) {
 	await (0, node_fs_promises.writeFile)(dockerignorePath, dockerignore);
 	logger$7.log(`\n   Generated: .dockerignore (workspace root)`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger$7.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${require_credentials.COMPOSE_PATH}`);
+	logger$7.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${require_workspace$1.COMPOSE_PATH}`);
 	logger$7.log("\n📋 Build commands:");
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
@@ -5278,18 +5304,18 @@ async function workspaceDockerCommand(workspace) {
 * describes and what `gkm dev` runs cannot disagree. Nothing is started.
 */
 async function writeConstructsCompose(workspace) {
-	await require_credentials.reconcileWorkspace(workspace, {
+	await require_workspace$1.reconcileWorkspace(workspace, {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger$7.log(`   Generated: ${require_credentials.COMPOSE_PATH} (project root)`);
-	return (0, node_path.join)(workspace.root, require_credentials.COMPOSE_PATH);
+	logger$7.log(`   Generated: ${require_workspace$1.COMPOSE_PATH} (project root)`);
+	return (0, node_path.join)(workspace.root, require_workspace$1.COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = (0, node_fs.existsSync)((0, node_path.join)(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
 	logger$7.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
 	logger$7.log("   gkm setup   # starts the containers and creates what they hold");
-	logger$7.log(`   docker compose -f ${require_credentials.COMPOSE_PATH}${project} --profile apps up --build`);
+	logger$7.log(`   docker compose -f ${require_workspace$1.COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/deploy/docker.ts
@@ -6972,7 +6998,7 @@ function requiredOf(requirements) {
 async function workspaceDeployCommand(configured, options) {
 	const { provider, stage, tag, apps: selectedApps } = options;
 	const manifest = await require_discover.discover({
-		patterns: require_credentials.constructGlobs(configured),
+		patterns: require_workspace$1.constructGlobs(configured),
 		cwd: configured.root
 	});
 	const units = deployUnits(manifest, configured);
@@ -8526,26 +8552,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.25",
-	"@geekmidas/auth": "~10.0.0-alpha.25",
-	"@geekmidas/cache": "~10.0.0-alpha.25",
-	"@geekmidas/client": "~10.0.0-alpha.25",
-	"@geekmidas/cloud": "~10.0.0-alpha.25",
-	"@geekmidas/constructs": "~10.0.0-alpha.25",
-	"@geekmidas/db": "~10.0.0-alpha.25",
-	"@geekmidas/emailkit": "~10.0.0-alpha.25",
-	"@geekmidas/envkit": "~10.0.0-alpha.25",
-	"@geekmidas/errors": "~10.0.0-alpha.25",
-	"@geekmidas/events": "~10.0.0-alpha.25",
-	"@geekmidas/logger": "~10.0.0-alpha.25",
-	"@geekmidas/manifest": "~10.0.0-alpha.25",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.25",
-	"@geekmidas/schema": "~10.0.0-alpha.25",
-	"@geekmidas/services": "~10.0.0-alpha.25",
-	"@geekmidas/storage": "~10.0.0-alpha.25",
-	"@geekmidas/studio": "~10.0.0-alpha.25",
-	"@geekmidas/telescope": "~10.0.0-alpha.25",
-	"@geekmidas/testkit": "~10.0.0-alpha.25",
+	"@geekmidas/audit": "~10.0.0-alpha.27",
+	"@geekmidas/auth": "~10.0.0-alpha.27",
+	"@geekmidas/cache": "~10.0.0-alpha.27",
+	"@geekmidas/client": "~10.0.0-alpha.27",
+	"@geekmidas/cloud": "~10.0.0-alpha.27",
+	"@geekmidas/constructs": "~10.0.0-alpha.27",
+	"@geekmidas/db": "~10.0.0-alpha.27",
+	"@geekmidas/emailkit": "~10.0.0-alpha.27",
+	"@geekmidas/envkit": "~10.0.0-alpha.27",
+	"@geekmidas/errors": "~10.0.0-alpha.27",
+	"@geekmidas/events": "~10.0.0-alpha.27",
+	"@geekmidas/logger": "~10.0.0-alpha.27",
+	"@geekmidas/manifest": "~10.0.0-alpha.27",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.27",
+	"@geekmidas/schema": "~10.0.0-alpha.27",
+	"@geekmidas/services": "~10.0.0-alpha.27",
+	"@geekmidas/storage": "~10.0.0-alpha.27",
+	"@geekmidas/studio": "~10.0.0-alpha.27",
+	"@geekmidas/telescope": "~10.0.0-alpha.27",
+	"@geekmidas/testkit": "~10.0.0-alpha.27",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -14460,7 +14486,7 @@ async function initCommand(projectName, options = {}) {
 	}
 	console.log("🔐 Initializing encrypted secrets...\n");
 	const local = templateOptions.stages.local;
-	const devSecrets = require_generator.createStageSecrets(local, [], { projectName: name });
+	const devSecrets = require_reconcile.createStageSecrets(local, [], { projectName: name });
 	const customSecrets = {
 		PORT: "3000",
 		LOG_LEVEL: "debug",
@@ -14645,7 +14671,7 @@ async function secretsInitCommand(options) {
 			logger$3.log("  Detected workspace mode — generating per-app secrets");
 		}
 	} catch {}
-	const secrets = require_generator.createStageSecrets(stage, [], { projectName });
+	const secrets = require_reconcile.createStageSecrets(stage, [], { projectName });
 	if (workspaceSecrets) secrets.custom = workspaceSecrets;
 	await require_storage.writeStageSecrets(secrets);
 	logger$3.log(`\n✓ Secrets initialized for stage "${stage}"`);
@@ -14743,13 +14769,13 @@ async function secretsRotateCommand(options) {
 			logger$3.error(`Service "${service}" not configured in stage "${stage}"`);
 			process.exit(1);
 		}
-		const updated = require_generator.rotateServicePassword(secrets, service);
+		const updated = require_reconcile.rotateServicePassword(secrets, service);
 		await require_storage.writeStageSecrets(updated);
 		logger$3.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
 	} else {
 		let updated = secrets;
 		const services = Object.keys(secrets.services);
-		for (const svc of services) updated = require_generator.rotateServicePassword(updated, svc);
+		for (const svc of services) updated = require_reconcile.rotateServicePassword(updated, svc);
 		await require_storage.writeStageSecrets(updated);
 		logger$3.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
 	}
@@ -14873,7 +14899,7 @@ function installation(platform, certificate) {
 */
 async function trustCommand(options = {}) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const certificate = (0, node_path.join)(workspace.root, require_credentials.LOCAL_CA_PATH);
+	const certificate = (0, node_path.join)(workspace.root, require_workspace$1.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, steps } = installation(process.platform, certificate);
 	logger$2.log(`\n🔐 Trusting the local authority in ${describe}`);
@@ -15016,7 +15042,7 @@ async function setupCommand(options = {}) {
 		logger$1.error("❌ Failed to resolve secrets. Exiting.");
 		process.exit(1);
 	}
-	const containers = await require_credentials.derivedContainers(workspace, stage);
+	const containers = await require_workspace$1.derivedContainers(workspace, stage);
 	if (isMultiApp && containers.includes("postgres")) {
 		await require_reconcile.writeDockerEnvFromSecrets(secrets, workspace.root);
 		logger$1.log("📄 Generated docker/.env with database passwords");
@@ -15035,7 +15061,7 @@ async function setupCommand(options = {}) {
 * free and quiet.
 */
 async function reconcileLocal(workspace, stage, options) {
-	const result = await require_credentials.reconcileWorkspace(workspace, { stage });
+	const result = await require_workspace$1.reconcileWorkspace(workspace, { stage });
 	if (result.plan.containers.length === 0) {
 		logger$1.log("🐳 No containers declared");
 		return;
@@ -15067,7 +15093,7 @@ async function resolveSecrets(stage, workspace, options) {
 		logger$1.log("🔐 Using existing local secrets");
 		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
 		if (secrets) {
-			const reconciled = reconcileSecrets(secrets, workspace, await require_credentials.derivedContainers(workspace, stage));
+			const reconciled = reconcileSecrets(secrets, workspace, await require_workspace$1.derivedContainers(workspace, stage));
 			if (reconciled) await require_storage.writeStageSecrets(reconciled, workspace.root);
 			return reconciled ?? secrets;
 		}
@@ -15115,7 +15141,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 	let changed = false;
 	let result = { ...secrets };
 	for (const name of credentialedServices(containers)) if (!result.services[name]) {
-		const creds = require_generator.generateServiceCredentials(name);
+		const creds = require_reconcile.generateServiceCredentials(name);
 		if (name === "minio") {
 			creds.bucket = workspace.name;
 			creds.username = workspace.name;
@@ -15127,7 +15153,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 				[name]: creds
 			}
 		};
-		result.urls = require_generator.generateConnectionUrls(result.services, result.eventsBackend);
+		result.urls = require_reconcile.generateConnectionUrls(result.services, result.eventsBackend);
 		logger$1.log(`   🔄 Adding missing service credentials: ${name}`);
 		changed = true;
 	}
@@ -15140,12 +15166,12 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 					host: result.services.postgres.host,
 					port: result.services.postgres.port,
 					username: "pgboss",
-					password: require_generator.generateSecurePassword(),
+					password: require_reconcile.generateSecurePassword(),
 					database: result.services.postgres.database ?? "app"
 				}
 			}
 		};
-		result.urls = require_generator.generateConnectionUrls(result.services, result.eventsBackend);
+		result.urls = require_reconcile.generateConnectionUrls(result.services, result.eventsBackend);
 		logger$1.log("   🔄 Adding missing service credentials: pgboss");
 		changed = true;
 	}
@@ -15180,7 +15206,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 */
 function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 	const serviceNames = credentialedServices(containers);
-	const secrets = require_generator.createStageSecrets(stage, serviceNames, { projectName: workspace.name });
+	const secrets = require_reconcile.createStageSecrets(stage, serviceNames, { projectName: workspace.name });
 	if (Object.keys(workspace.apps).length > 1) secrets.custom = require_reconcile.generateFullstackCustomSecrets(workspace, containers);
 	else secrets.custom = {
 		PORT: "3000",
@@ -15202,7 +15228,7 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
 	if (require_storage.secretsExist(stage, workspace.root)) return false;
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_credentials.derivedContainers(workspace, stage));
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_workspace$1.derivedContainers(workspace, stage));
 	await require_storage.writeStageSecrets(secrets, workspace.root);
 	return true;
 }
@@ -15210,7 +15236,7 @@ async function ensureStageSecrets(stage, cwd = process.cwd()) {
 * Generate fresh secrets for the workspace.
 */
 async function generateFreshSecrets(stage, workspace, options) {
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_credentials.derivedContainers(workspace, stage));
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_workspace$1.derivedContainers(workspace, stage));
 	await require_storage.writeStageSecrets(secrets, workspace.root);
 	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
 	if (require_transfer.isRemoteStore(workspace, stage) && !options.yes) {
@@ -15485,13 +15511,12 @@ async function testCommand(options = {}) {
 		const { ensureStageSecrets } = await Promise.resolve().then(() => setup_exports);
 		if (await ensureStageSecrets(stage, cwd)) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
-	const defaultEnv = require_credentials.loadEnvFiles(".env");
+	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const result = await require_credentials.prepareEntryCredentials({
+	const result = await require_workspace$1.prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
-		resolveDockerPorts: "full",
 		reconcileStage: "test"
 	});
 	let finalCredentials = { ...result.credentials };
@@ -15505,18 +15530,17 @@ async function testCommand(options = {}) {
 			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)` + (result.declaredKeys.length > 0 ? `, kept ${result.declaredKeys.length} declared` : ""));
 		}
 	}
-	finalCredentials = rewriteDatabaseUrlForTests(finalCredentials);
 	console.log("");
 	await (0, node_fs_promises.writeFile)(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = (0, node_path.join)(cwd, ".gkm");
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
-	await require_credentials.createCredentialsPreload(preloadPath, result.secretsJsonPath);
+	await require_workspace$1.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-	const manifestPath = workspace && require_credentials.usesConstructs(workspace) ? await writeTestHarness({
+	const manifestPath = workspace ? await writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path))],
-		patterns: require_credentials.constructGlobs(workspace),
-		cacheBackend: require_credentials.backendsOf(workspace).cache,
+		patterns: require_workspace$1.constructGlobs(workspace),
+		cacheBackend: require_workspace$1.backendsOf(workspace).cache,
 		stage: require_workspace.TEST_STAGE,
 		env: finalCredentials
 	}) : void 0;
@@ -15556,29 +15580,6 @@ async function testCommand(options = {}) {
 		});
 	});
 }
-const TEST_DB_SUFFIX = "_test";
-/**
-* Rewrite DATABASE_URL to point to a separate test database.
-* Appends `_test` to the database name (e.g., `app` -> `app_test`).
-* @internal Exported for testing
-*/
-function rewriteDatabaseUrlForTests(env) {
-	const result = { ...env };
-	for (const key of Object.keys(result)) {
-		if (!key.includes("DATABASE_URL")) continue;
-		const value = result[key];
-		try {
-			const url = new URL(value);
-			const dbName = url.pathname.slice(1);
-			if (dbName && !dbName.endsWith(TEST_DB_SUFFIX)) {
-				url.pathname = `/${dbName}${TEST_DB_SUFFIX}`;
-				result[key] = url.toString();
-				console.log(`  🧪 ${key}: using test database "${dbName}${TEST_DB_SUFFIX}"`);
-			}
-		} catch {}
-	}
-	return result;
-}
 /** `gkm test` outside a project that declares stages, with none named. */
 var NoStageToTest = class extends Error {
 	constructor() {
@@ -16119,7 +16120,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushStageSecrets } = await Promise.resolve().then(() => require("./transfer-D59M4aaR.cjs")).then((n) => n.transfer_exports);
+		const { pushStageSecrets } = await Promise.resolve().then(() => require("./transfer-BYIn7z8m.cjs")).then((n) => n.transfer_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16134,7 +16135,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullStageSecrets } = await Promise.resolve().then(() => require("./transfer-D59M4aaR.cjs")).then((n) => n.transfer_exports);
+		const { pullStageSecrets } = await Promise.resolve().then(() => require("./transfer-BYIn7z8m.cjs")).then((n) => n.transfer_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16149,7 +16150,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-hx_vBvux.cjs")).then((n) => n.reconcile_exports);
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-szmJw_Sb.cjs")).then((n) => n.reconcile_exports);
 		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-DgypfSD6.cjs")).then((n) => n.storage_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
@@ -16158,7 +16159,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./credentials-Dbyccl3A.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-DgeVgxmm.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16217,7 +16218,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CUjW3G91.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CQflOKKV.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));