@geekmidas/cli 10.0.0-alpha.26 → 10.0.0-alpha.28

package/dist/{credentials-DI9kJcaP.mjs → workspace-cBobQVoA.mjs}

@@ -1,23 +1,242 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { a as DEFAULT_EVENTS$1, i as DEFAULT_CACHE, o as DEFAULT_STORAGE, t as discover } from "./discover-0fhCbnk0.mjs";
-import { a as loadWorkspaceAppInfo, c as appKey, n as getAppNameFromCwd, o as loadWorkspaceConfig } from "./config-DBGpRTUy.mjs";
-import { s as getDependencyEnvVars, t as allConstructGlobs, w as TEST_STAGE } from "./workspace-Bu3xNCej.mjs";
-import { r as generatePgBossUrl } from "./generator-LfZU7NlU.mjs";
+import { a as DEFAULT_EVENTS$1, i as DEFAULT_CACHE, o as DEFAULT_STORAGE, t as discover } from "./discover-CXGlQHm1.mjs";
+import { l as appKey, o as loadWorkspaceAppInfo, r as getAppNameFromCwd, s as loadWorkspaceConfig } from "./config-Dqxa-_Ge.mjs";
+import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-T4IVGSoB.mjs";
 import { n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist } from "./storage-TP0x118M.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { execFile, execSync } from "node:child_process";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { execFile } from "node:child_process";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { config } from "dotenv";
-import { parse as parse$1, stringify } from "yaml";
 import { createHash } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { Client } from "pg";
+import { stringify } from "yaml";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
+//#region src/credentials/index.ts
+const logger = console;
+/**
+* Load environment files
+* @internal Exported for testing
+*/
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = resolve(cwd, envFile);
+		if (existsSync(envPath)) {
+			config({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
+/**
+* Check if a port is available
+* @internal Exported for testing
+*/
+async function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve(false);
+			else resolve(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve(true);
+		});
+		server.listen(port);
+	});
+}
+/**
+* Find an available port starting from the preferred port
+* @internal Exported for testing
+*/
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+	}
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+}
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = join(workspaceRoot, ".gkm");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
+*/
+async function loadSecretsForApp(secretsRoot, stage, appName) {
+	let secrets = {};
+	if (secretsExist(stage, secretsRoot)) {
+		const stageSecrets = await readStageSecrets(stage, secretsRoot);
+		if (stageSecrets) {
+			logger.log(`🔐 Loading secrets from stage: ${stage}`);
+			secrets = toEmbeddableSecrets(stageSecrets);
+		}
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
+}
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
+}
+/**
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
+*/
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
+}
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await writeFile(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await writeFile(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	let workspace;
+	try {
+		appInfo = await loadWorkspaceAppInfo(cwd);
+		workspace = appInfo.workspace;
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch {
+		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
+		appName = getAppNameFromCwd(cwd) ?? void 0;
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const stage = options.stage ?? workspace?.stages.local;
+	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
+	credentials.PORT = String(resolvedPort);
+	const declaredKeys = [];
+	if (workspace) {
+		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
+		const reconciled = await reconcileWorkspace(workspace, {
+			stage: options.reconcileStage ?? workspace.stages.local,
+			start: options.startDocker ?? false
+		});
+		Object.assign(credentials, reconciled.env);
+		declaredKeys.push(...Object.keys(reconciled.env));
+		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+	}
+	const secretsDir = join(secretsRoot, ".gkm");
+	await mkdir(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = join(secretsDir, secretsFileName);
+	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo,
+		declaredKeys
+	};
+}
+//#endregion
 //#region src/workspace/backends.ts
 /**
 * Which backend each declared kind resolves to — decided by where the project
@@ -296,11 +515,16 @@ function portOf(address) {
 */
 function hostFor(resource, project) {
 	return [
-		resource.name,
+		resource.root && project ? stageOf(resource) : resource.name,
 		project,
 		LOCAL_TLD
 	].filter(Boolean).join(".");
 }
+/** The stage a resource's name carries, or nothing for the local stage's. */
+function stageOf(resource) {
+	const base = resource.id.toLowerCase();
+	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+}
 /**
 * The static root config, which only ever imports.
 *
@@ -367,6 +591,49 @@ const GENERATED = `# Generated by gkm from the construct manifest — do not edi
 # from code; a browser needs the root trusted once.
 `;
 //#endregion
+//#region src/workspace/rootSite.ts
+/**
+* Which site the base domain points at — deployed and locally alike.
+*
+* Three rules, in order, and the last one is the point:
+*
+* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
+* 2. **Named `web`** — the convention wins, because people already rely on it.
+* 3. **Declared `root: true`** — the site says so itself.
+*
+* Anything else throws. It used to take the *first* site it iterated, and that
+* order came from the manifest, which is built in glob traversal order — so two
+* sites with neither named `web` meant renaming a file could move the root
+* domain, silently.
+*
+* One rule for both targets: deployed the root site gets the base domain, and
+* locally it gets the project's bare host behind the edge. Before this was
+* shared, the local edge put every site on a subdomain, so what a developer
+* browsed was not the shape production served.
+*
+* @returns the root site's name, or `undefined` when there are no sites
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
+*/
+function rootSite(sites) {
+	if (sites.length === 0) return void 0;
+	if (sites.length === 1) return sites[0].name;
+	if (sites.some(({ name }) => name === "web")) return "web";
+	const declared = sites.filter(({ root }) => root === true);
+	if (declared.length === 1) return declared[0].name;
+	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
+}
+/** Several sites could hold the base domain, and none of them says it does. */
+var AmbiguousRootSite = class extends Error {
+	sites;
+	tooMany;
+	constructor(sites, tooMany = false) {
+		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a hostname.`);
+		this.sites = sites;
+		this.tooMany = tooMany;
+		this.name = "AmbiguousRootSite";
+	}
+};
+//#endregion
 //#region src/reconcile/plan.ts
 /**
 * The reconcile plan — what a manifest wants to exist, for one stage.
@@ -574,6 +841,15 @@ function planFor(manifest, stage, order, options = {}) {
 			for (const resource of placeless) resource.of = only.id;
 		}
 	}
+	const sites = resources.filter((r) => r.kind === "site");
+	const root = rootSite(sites.map((r) => {
+		const declared = manifest[r.id];
+		return {
+			name: appKey(r.id),
+			...declared?.kind === "site" && declared.root ? { root: true } : {}
+		};
+	}));
+	for (const site of sites) if (appKey(site.id) === root) site.root = true;
 	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
 	return {
 		stage,
@@ -1057,14 +1333,67 @@ function inNetworkEnv(workspace, manifest) {
 	});
 	return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, rewrite(value)]));
 }
+/**
+* The keys one app's environment may hold: what its own declaration provides
+* and requires, and what each construct it has an edge to provides.
+*
+* The edges, not the manifest. Every app used to be handed every key the
+* workspace resolved — a web app got the database's owner URL and the auth
+* server's signing secret, and the API got the auth server's database — which
+* is exactly what a declared edge exists to rule out. A deploy composes an
+* app's environment from its edges; so does this.
+*
+* One hop: a surface an app calls is reached over HTTP, so its URL is the
+* app's business and its database is not. A site also gets the public
+* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`), and a surface
+* the edges of the workers whose crons and subscribers its server runs.
+*
+* `undefined` for an app no declaration describes, which gets nothing but its
+* port.
+*/
+function appEnvKeys(manifest, appName, runnables = {}) {
+	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site") && appKey(id) === appName);
+	if (!entry) return void 0;
+	const [id, declaration] = entry;
+	const keys = /* @__PURE__ */ new Set([
+		...declaration.provides ?? [],
+		...declaration.requires ?? [],
+		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
+	]);
+	const edges = [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
+	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) for (const [otherId, other] of Object.entries(manifest)) {
+		if (other.kind !== "worker") continue;
+		edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
+		keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+		keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
+	}
+	for (const id of edges) {
+		const target = manifest[id];
+		if (!target) continue;
+		for (const key of target.provides ?? []) keys.add(key);
+		if (target.kind === "queue" || target.kind === "topic") {
+			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+			keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
+		}
+		if (target.kind === "objects") {
+			keys.add("AWS_ACCESS_KEY_ID");
+			keys.add("AWS_SECRET_ACCESS_KEY");
+			keys.add("AWS_REGION");
+		}
+	}
+	if (declaration.kind === "site") for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
+	return keys;
+}
 /** One compose service per app the workspace runs, behind the apps profile. */
-function appServices(workspace, manifest, containers) {
+function appServices(workspace, manifest, containers, runnables = {}) {
 	const env = inNetworkEnv(workspace, manifest);
 	const services = {};
 	for (const [name, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile" || !app.port) continue;
 		const key = appKey(name);
 		const health = app.type === "web" ? "/" : "/health";
+		const allowed = appEnvKeys(manifest, name, runnables);
+		const own = Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey)));
 		services[key] = {
 			image: `${key}:\${TAG:-latest}`,
 			build: {
@@ -1076,7 +1405,7 @@ function appServices(workspace, manifest, containers) {
 			environment: {
 				NODE_ENV: "production",
 				PORT: String(app.port),
-				...env
+				...own
 			},
 			...containers.some((c) => c !== "caddy") ? { depends_on: containers.filter((c) => c !== "caddy") } : {},
 			healthcheck: {
@@ -2235,8 +2564,7 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	reconcileWorkspace: () => reconcileWorkspace,
-	surfaceAddresses: () => surfaceAddresses,
-	usesConstructs: () => usesConstructs
+	surfaceAddresses: () => surfaceAddresses
 });
 /**
 * Every constructs glob in the workspace, resolved against its app.
@@ -2247,10 +2575,6 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 function constructGlobs(workspace) {
 	return allConstructGlobs(workspace);
 }
-/** Whether any app has adopted the constructs glob. */
-function usesConstructs(workspace) {
-	return constructGlobs(workspace).length > 0;
-}
 /** The backends a workspace's target implies, as the plan takes them. */
 function backendsOf(workspace) {
 	const on = providerOf(workspace);
@@ -2286,10 +2610,13 @@ async function derivedContainers(workspace, stage, manifest) {
 * stays a pure-ish function of its inputs and the store keeps its single owner.
 */
 async function reconcileWorkspace(workspace, options) {
-	const manifest = options.manifest ?? await discover({
+	const runnables = {};
+	const discovered = await discover({
 		patterns: constructGlobs(workspace),
-		cwd: workspace.root
+		cwd: workspace.root,
+		runnables
 	});
+	const manifest = options.manifest ?? discovered;
 	const result = await reconcile({
 		root: workspace.root,
 		project: workspace.name,
@@ -2299,7 +2626,7 @@ async function reconcileWorkspace(workspace, options) {
 		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
-		apps: (containers) => appServices(workspace, manifest, containers),
+		apps: (containers) => appServices(workspace, manifest, containers, runnables),
 		...options.start === void 0 ? {} : { start: options.start }
 	});
 	await savePortState(workspace.root, { ...result.ports });
@@ -2336,484 +2663,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/credentials/index.ts
-const logger = console;
-/**
-* Load environment files
-* @internal Exported for testing
-*/
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = resolve(cwd, envFile);
-		if (existsSync(envPath)) {
-			config({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
-}
-/**
-* Check if a port is available
-* @internal Exported for testing
-*/
-async function isPortAvailable(port) {
-	return new Promise((resolve) => {
-		const server = createServer();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve(false);
-			else resolve(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve(true);
-		});
-		server.listen(port);
-	});
-}
-/**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
-*/
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
-	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
-}
-const PORT_STATE_PATH = ".gkm/ports.json";
-/**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
-*/
-function parseComposePortMappings(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
-}
-/**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function loadPortState(workspaceRoot) {
-	try {
-		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-/**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function savePortState(workspaceRoot, ports) {
-	const dir = join(workspaceRoot, ".gkm");
-	await mkdir(dir, { recursive: true });
-	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
-/**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
-*/
-function getContainerHostPort(workspaceRoot, service, containerPort) {
-	try {
-		const match = execSync(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim().match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function resolveServicePorts(workspaceRoot) {
-	const mappings = parseComposePortMappings(join(workspaceRoot, "docker-compose.yml"));
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
-	}
-	await savePortState(workspaceRoot, ports);
-	return {
-		dockerEnv,
-		ports,
-		mappings
-	};
-}
-/**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
-*/
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
-}
-/**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
-*/
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
-	}
-	return result;
-}
-/**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
-*/
-function buildDockerComposeEnv(secretsEnv, portEnv) {
-	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
-	};
-}
-/**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
-*/
-function parseComposeServiceNames(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	return Object.keys(compose?.services ?? {});
-}
-/**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
-*/
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = join(cwd, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
-*/
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = join(workspace.root, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name) => !appNames.has(name));
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
-*/
-async function loadSecretsForApp(secretsRoot, stage, appName) {
-	let secrets = {};
-	if (secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = toEmbeddableSecrets(stageSecrets);
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
-}
-/**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
-*/
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
-/**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
-*/
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
-}
-`;
-}
-/**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
-*/
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await writeFile(preloadPath, content);
-}
-/**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
-*/
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await writeFile(wrapperPath, content);
-}
-/**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
-*
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
-*/
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	let workspace;
-	try {
-		appInfo = await loadWorkspaceAppInfo(cwd);
-		workspace = appInfo.workspace;
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
-		appName = getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const stage = options.stage ?? workspace?.stages.local;
-	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
-	credentials.PORT = String(resolvedPort);
-	const declaredKeys = [];
-	if (workspace && usesConstructs(workspace)) {
-		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
-		const reconciled = await reconcileWorkspace(workspace, {
-			stage: options.reconcileStage ?? workspace.stages.local,
-			start: options.startDocker ?? false
-		});
-		Object.assign(credentials, reconciled.env);
-		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
-	} else {
-		const mappings = parseComposePortMappings(join(secretsRoot, "docker-compose.yml"));
-		if (mappings.length > 0) {
-			let resolvedPorts;
-			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-			else {
-				const savedPorts = await loadPortState(secretsRoot);
-				const ports = {};
-				for (const mapping of mappings) {
-					const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-					if (containerPort !== null) ports[mapping.envVar] = containerPort;
-					else {
-						const saved = savedPorts[mapping.envVar];
-						if (saved !== void 0) ports[mapping.envVar] = saved;
-					}
-				}
-				resolvedPorts = {
-					dockerEnv: {},
-					ports,
-					mappings
-				};
-			}
-			if (options.startDocker) {
-				if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-				else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-			}
-			if (Object.keys(resolvedPorts.ports).length > 0) {
-				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-				Object.assign(credentials, rewritten);
-				logger.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-			}
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		for (const [key, value] of Object.entries(depEnv)) credentials[key] ??= value;
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
-	const secretsDir = join(secretsRoot, ".gkm");
-	await mkdir(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = join(secretsDir, secretsFileName);
-	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo,
-		declaredKeys
-	};
-}
-//#endregion
-export { providerOf as C, eventsBackendFor as S, COMPOSE_PATH as _, loadEnvFiles as a, resourceName as b, resolveServicePorts as c, backendsOf as d, constructGlobs as f, workspace_exports as g, usesConstructs as h, isPortAvailable as i, rewriteUrlsWithPorts as l, reconcileWorkspace as m, createEntryWrapper as n, loadSecretsForApp as o, derivedContainers as p, findAvailablePort as r, prepareEntryCredentials as s, createCredentialsPreload as t, startWorkspaceServices as u, LOCAL_CA_PATH as v, storageBackendFor as w, cacheBackendFor as x, applyPostgres as y };
+export { findAvailablePort as _, workspace_exports as a, loadSecretsForApp as b, applyPostgres as c, cacheBackendFor as d, eventsBackendFor as f, createEntryWrapper as g, createCredentialsPreload as h, reconcileWorkspace as i, resourceName as l, storageBackendFor as m, constructGlobs as n, COMPOSE_PATH as o, providerOf as p, derivedContainers as r, LOCAL_CA_PATH as s, backendsOf as t, rootSite as u, isPortAvailable as v, prepareEntryCredentials as x, loadEnvFiles as y };
 
-//# sourceMappingURL=credentials-DI9kJcaP.mjs.map
+//# sourceMappingURL=workspace-cBobQVoA.mjs.map