@geekmidas/cli 10.0.0-alpha.27 → 10.0.0-alpha.29

package/dist/index.cjs

@@ -1,15 +1,14 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_discover = require("./discover-B_HtYJCr.cjs");
-const require_config = require("./config-7R_-WyHq.cjs");
+const require_discover = require("./discover-BTh87DOO.cjs");
+const require_config = require("./config-BTFLHfRb.cjs");
 const require_workspace = require("./workspace-Bav3TVrP.cjs");
-const require_storage = require("./storage-DgypfSD6.cjs");
-const require_workspace$1 = require("./workspace-DgeVgxmm.cjs");
-const require_openapi = require("./openapi-rhJdy2GC.cjs");
+const require_storage = require("./storage-C2JC31V9.cjs");
+const require_workspace$1 = require("./workspace-B3ApLW6p.cjs");
+const require_openapi = require("./openapi-K4H5tHzA.cjs");
 const require_emit = require("./emit-BdoPFjZf.cjs");
-const require_reconcile = require("./reconcile-szmJw_Sb.cjs");
-const require_transfer = require("./transfer-BYIn7z8m.cjs");
+const require_reconcile = require("./reconcile-BxZTV2vl.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
 let node_readline_promises = require("node:readline/promises");
@@ -22,6 +21,7 @@ let node_child_process = require("node:child_process");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let fast_glob = require("fast-glob");
 fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
+let node_module = require("node:module");
 let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
 let node_crypto = require("node:crypto");
@@ -31,19 +31,18 @@ let pg = require("pg");
 let yaml = require("yaml");
 let node_util = require("node:util");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
+let prompts = require("prompts");
+prompts = require_rolldown_runtime.__toESM(prompts, 1);
 let _geekmidas_constructs_crons = require("@geekmidas/constructs/crons");
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_subscribers = require("@geekmidas/constructs/subscribers");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
-let node_module = require("node:module");
-let prompts = require("prompts");
-prompts = require_rolldown_runtime.__toESM(prompts, 1);
 let _geekmidas_envkit = require("@geekmidas/envkit");
 let _geekmidas_services = require("@geekmidas/services");
 //#region package.json
-var version = "10.0.0-alpha.27";
+var version = "10.0.0-alpha.29";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -410,8 +409,182 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
-//#region src/exec/index.ts
+//#region src/trust/index.ts
+/**
+* Installing the local edge's certificate authority into the OS trust store.
+*
+* `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test
+* suite, anything under `gkm exec` — because reconcile injects it. A browser
+* reads none of that: it asks the operating system, so until the root is in the
+* system store a local `https://` address is "not secure", which is true and
+* unhelpful.
+*
+* A separate command rather than part of `gkm setup`, for one reason: this
+* needs `sudo`, and a setup that silently escalates on every run is a worse
+* trade than one that tells you what to type. Caddy's own `caddy trust` draws
+* the line in the same place.
+*/
 const logger$12 = console;
+const run = (0, node_util.promisify)(node_child_process.execFile);
+/**
+* How each platform is told about a new authority.
+*
+* Separate rather than shelled through one script because the failure modes
+* differ and the message should name the real one: macOS refuses without an
+* admin password, Debian needs the file in a specific directory before its
+* updater will look at it.
+*/
+function installation(platform, certificate) {
+	if (platform === "darwin") return {
+		describe: "the System keychain",
+		steps: [["sudo", [
+			"security",
+			"add-trusted-cert",
+			"-d",
+			"-r",
+			"trustRoot",
+			"-k",
+			"/Library/Keychains/System.keychain",
+			certificate
+		]]]
+	};
+	if (platform === "linux") {
+		const debian = (0, node_fs.existsSync)("/usr/local/share/ca-certificates");
+		return {
+			describe: debian ? "the system CA bundle" : "the system trust anchors",
+			steps: debian ? [["sudo", [
+				"cp",
+				certificate,
+				"/usr/local/share/ca-certificates/gkm-local-ca.crt"
+			]], ["sudo", ["update-ca-certificates"]]] : [["sudo", [
+				"cp",
+				certificate,
+				"/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt"
+			]], ["sudo", ["update-ca-trust"]]]
+		};
+	}
+	throw new UnsupportedPlatform(platform, certificate);
+}
+/**
+* Trust the certificate authority this project's edge issues from.
+*
+* Idempotent in effect: installing a root that is already trusted replaces the
+* same entry, so running it twice is not an error.
+*/
+async function trustCommand(options = {}) {
+	const { workspace } = await require_config.loadWorkspaceConfig();
+	const certificate = (0, node_path.join)(workspace.root, require_workspace$1.LOCAL_CA_PATH);
+	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
+	const { describe, steps } = installation(process.platform, certificate);
+	logger$12.log(`\n🔐 Trusting the local authority in ${describe}`);
+	logger$12.log(`   ${certificate}\n`);
+	if (options.dryRun) {
+		for (const [command, args] of steps) logger$12.log(`   ${command} ${args.join(" ")}`);
+		return;
+	}
+	logger$12.log("   This needs an admin password.\n");
+	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
+	logger$12.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
+}
+/**
+* Trust the authority if this machine lacks it and its owner agrees.
+*
+* A machine's answer, not the project's: whether a laptop installs a root
+* certificate is its owner's call, so the decision is `--yes`, then what this
+* machine previously answered, then a prompt. Never a silent `sudo` — that is
+* the one thing a setup command should not do on somebody's behalf.
+*
+* Silent and free when the machine already trusts it, which is what makes it
+* acceptable to call on every `gkm setup`.
+*/
+async function ensureTrusted(root, url, options = {}) {
+	if (await isTrusted(url)) return;
+	if (!options.assumeYes) {
+		if (!process.stdin.isTTY) {
+			logger$12.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
+			return;
+		}
+		if (await declined(root)) return;
+		const { install } = await (0, prompts.default)({
+			type: "confirm",
+			name: "install",
+			message: "Trust this project's local certificate authority, so a browser accepts its https addresses? (needs sudo)",
+			initial: false
+		});
+		if (!install) {
+			await recordDeclined(root);
+			logger$12.log("   Skipped. Run \"gkm trust\" later.");
+			return;
+		}
+	}
+	await trustCommand();
+}
+/** Where a declined answer is remembered, so setup asks once and not again. */
+const TRUST_STATE = ".gkm/trust.json";
+async function declined(root) {
+	try {
+		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(root, TRUST_STATE), "utf-8");
+		return JSON.parse(raw).declined === true;
+	} catch {
+		return false;
+	}
+}
+async function recordDeclined(root) {
+	const path = (0, node_path.join)(root, TRUST_STATE);
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
+	await (0, node_fs_promises.writeFile)(path, `${JSON.stringify({ declined: true }, null, 2)}\n`);
+}
+/**
+* Whether this machine already trusts the local authority.
+*
+* Asked by connecting rather than by reading a keychain: what matters is
+* whether a client with no special configuration verifies the edge, and that is
+* one platform-neutral question instead of three platform-specific ones. It is
+* also the exact thing a browser is about to do.
+*
+* A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and
+* this process almost certainly has it set — asking in-process would answer
+* "yes" for everyone.
+*/
+async function isTrusted(url) {
+	const { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;
+	try {
+		await run(process.execPath, [
+			"--use-system-ca",
+			"-e",
+			`fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`
+		], {
+			env,
+			timeout: 15e3
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** The edge has not run, so there is no authority to trust yet. */
+var NoLocalAuthority = class extends Error {
+	path;
+	constructor(path) {
+		super(`No local certificate authority at ${path}. It is generated the first time the edge starts, so run "gkm setup" (or "gkm dev") once — and if this project declares no file server, nothing needs one.`);
+		this.path = path;
+		this.name = "NoLocalAuthority";
+	}
+};
+/** A platform with no trust store this knows how to write to. */
+var UnsupportedPlatform = class extends Error {
+	platform;
+	certificate;
+	constructor(platform, certificate) {
+		super(`gkm does not know how to install a certificate authority on ${platform}. The root is at ${certificate} — add it to the trust store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`);
+		this.platform = platform;
+		this.certificate = certificate;
+		this.name = "UnsupportedPlatform";
+	}
+};
+//#endregion
+//#region src/exec/index.ts
+const logger$11 = console;
 /** `gkm exec` was given nothing to run. */
 var NoCommandSpecified = class extends Error {
 	constructor() {
@@ -434,17 +607,17 @@ async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, secretsJsonPath, appName } = await require_workspace$1.prepareEntryCredentials({ cwd });
-	if (appName) logger$12.log(`📦 App: ${appName}`);
+	if (appName) logger$11.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$11.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
 	await require_workspace$1.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
-	logger$12.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$11.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
 	const child = (0, node_child_process.spawn)(cmd, args, {
 		cwd,
@@ -458,7 +631,7 @@ async function execCommand(commandArgs, options = {}) {
 	const exitCode = await new Promise((resolve) => {
 		child.on("close", (code) => resolve(code ?? 0));
 		child.on("error", (error) => {
-			logger$12.error(`Failed to run command: ${error.message}`);
+			logger$11.error(`Failed to run command: ${error.message}`);
 			resolve(1);
 		});
 	});
@@ -466,7 +639,7 @@ async function execCommand(commandArgs, options = {}) {
 }
 //#endregion
 //#region src/dev/index.ts
-const logger$11 = console;
+const logger$10 = console;
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -560,7 +733,7 @@ function getProductionConfigFromGkm(config) {
 async function devCommand(options) {
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appName = require_config.getAppNameFromCwd();
 	let config;
 	let appRoot = process.cwd();
@@ -576,9 +749,8 @@ async function devCommand(options) {
 		workspaceAppName = appConfig.appName;
 		workspaceAppPort = appConfig.app.port;
 		workspace = appConfig.workspace;
-		logger$11.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
 		if (appConfig.app.entry) {
-			logger$11.log(`📄 Using entry point: ${appConfig.app.entry}`);
+			logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
 			return entryDevCommand({
 				...options,
 				entry: appConfig.app.entry,
@@ -588,39 +760,27 @@ async function devCommand(options) {
 		}
 	} catch {
 		const loadedConfig = await require_config.loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") {
-			logger$11.log("📦 Detected workspace configuration");
-			return workspaceDevCommand(loadedConfig.workspace, options);
-		}
+		if (loadedConfig.type === "workspace") return workspaceDevCommand(loadedConfig.workspace, options);
 		config = loadedConfig.raw;
 		workspace = loadedConfig.workspace;
 	}
 	else {
 		const loadedConfig = await require_config.loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") {
-			logger$11.log("📦 Detected workspace configuration");
-			return workspaceDevCommand(loadedConfig.workspace, options);
-		}
+		if (loadedConfig.type === "workspace") return workspaceDevCommand(loadedConfig.workspace, options);
 		config = loadedConfig.raw;
 		workspace = loadedConfig.workspace;
 	}
 	if (config.env) {
 		const { loaded, missing } = require_workspace$1.loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$11.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$11.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (loaded.length > 0) logger$10.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$10.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const resolved = resolveProviders(config, { provider: "server" });
-	logger$11.log("🚀 Starting development server...");
-	logger$11.log(`Loading constructs from: ${config.constructs}`);
 	const telescope = normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$11.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = normalizeStudioConfig(config.studio);
-	if (studio) logger$11.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	if (hooks) logger$11.log(`🪝 Server hooks enabled from ${config.hooks?.server}`);
 	const enableOpenApi = require_openapi.resolveOpenApiConfig(config).enabled || resolved.enableOpenApi;
-	if (enableOpenApi) logger$11.log(`📄 OpenAPI output: ${require_openapi.OPENAPI_OUTPUT_PATH}`);
-	const build = (bustCache = false) => buildApp({
+	const build = (bustCache = false) => quietly(() => buildApp({
 		config,
 		workspaceRoot: workspace?.root ?? secretsRoot,
 		appRoot,
@@ -633,18 +793,21 @@ async function devCommand(options) {
 		skipBundle: true,
 		bustCache,
 		serveEmpty: true
-	});
+	}));
 	const initial = await build();
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
+	let publicUrl;
 	const appSecrets = await require_workspace$1.loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
 	if (workspace) {
 		const reconciled = await require_workspace$1.reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
+			logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
+			for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
 		}
 		Object.assign(appSecrets, reconciled.env);
+		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_config.appKey(r.id) === workspaceAppName);
+		publicUrl = own ? reconciled.env[own.envKey] : void 0;
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
@@ -652,13 +815,13 @@ async function devCommand(options) {
 		const secretsFileName = workspaceAppName ? `dev-secrets-${workspaceAppName}.json` : "dev-secrets.json";
 		secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
 		await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
-		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
 	}
 	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
+	devServer.label = workspaceAppName ?? "server";
+	devServer.publicUrl = publicUrl;
 	await devServer.start();
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
 	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
-	logger$11.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
 	const resolvedFiles = await (0, fast_glob.default)(normalizedPatterns, {
 		cwd: appRoot,
 		absolute: false,
@@ -667,34 +830,28 @@ async function devCommand(options) {
 	const dirsToWatch = [...new Set(resolvedFiles.map((f) => {
 		return f.split("/").slice(0, -1).join("/");
 	}))];
-	logger$11.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
 	const watcher = chokidar.default.watch([...resolvedFiles, ...dirsToWatch], {
 		ignored: /(^|[/\\])\../,
 		persistent: true,
 		ignoreInitial: true,
 		cwd: appRoot
 	});
-	watcher.on("ready", () => {
-		logger$11.log("🔍 File watcher ready");
-	});
 	watcher.on("error", (error) => {
-		logger$11.error("❌ Watcher error:", error);
+		logger$10.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$11.log(`📝 File changed: ${path}`);
+		logger$10.log(`🔄 ${path} changed — rebuilding`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
-				logger$11.log("🔄 Rebuilding...");
 				const rebuilt = await build(true);
-				logger$11.log("✅ Rebuild complete, restarting server...");
 				devServer.selfServing = rebuilt.selfServing !== void 0;
 				await devServer.restart();
 			} catch (error) {
 				const err = error;
-				logger$11.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$11.error(err.stack);
+				logger$10.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$10.error(err.stack);
 			}
 		}, 300);
 	});
@@ -702,9 +859,9 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down...");
+		logger$10.log("\n🛑 Shutting down...");
 		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
-			logger$11.error("Error during shutdown:", err);
+			logger$10.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -890,12 +1047,8 @@ async function loadDevSecrets(workspace) {
 	const stage = workspace.stages.local;
 	if (require_storage.secretsExist(stage, workspace.root)) {
 		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			logger$11.log(`🔐 Loading secrets from stage: ${stage}`);
-			return require_storage.toEmbeddableSecrets(secrets);
-		}
+		if (secrets) return require_storage.toEmbeddableSecrets(secrets);
 	}
-	logger$11.warn(`⚠️  Secrets enabled but no "${stage}" secrets found. Run "gkm setup" to initialize the local stage`);
 	return {};
 }
 /**
@@ -909,38 +1062,30 @@ async function loadDevSecrets(workspace) {
 */
 async function workspaceDevCommand(workspace, options) {
 	const appCount = Object.keys(workspace.apps).length;
-	const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend");
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
-	const mobileApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "mobile");
-	logger$11.log(`\n🚀 Starting workspace: ${workspace.name}`);
-	const counts = [`${backendApps.length} backend`, `${frontendApps.length} web`];
-	if (mobileApps.length > 0) counts.push(`${mobileApps.length} mobile`);
-	logger$11.log(`   ${counts.join(", ")} app(s)`);
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$11.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$10.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
-		logger$11.log("\n🔍 Validating frontend apps...");
 		const validationResults = await validateFrontendApps(workspace);
 		let hasErrors = false;
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$11.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$11.error(`   • ${error}`);
+				logger$10.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$10.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$11.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$10.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
-		logger$11.log("✅ Frontend apps validated");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
 	const reconciled = await require_workspace$1.reconcileWorkspace(workspace, { stage: workspace.stages.local });
 	if (reconciled.changed && reconciled.plan.containers.length > 0) {
-		logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-		for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
+		logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
+		for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
 	}
 	const secretsEnv = {
 		...rawSecrets,
@@ -952,11 +1097,8 @@ async function workspaceDevCommand(workspace, options) {
 		const address = reconciled.env[resource.envKey];
 		if (address) appUrls[resource.id] = address;
 	}
-	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
-	if (Object.keys(appUrls).length > 0) {
-		logger$11.log("🔒 App URLs:");
-		for (const [id, address] of Object.entries(appUrls)) logger$11.log(`   ${id}: ${address}`);
-	}
+	const firstUrl = Object.values(appUrls).find((url) => url.startsWith("https://"));
+	if (firstUrl) await ensureTrusted(workspace.root, firstUrl);
 	let turboFilter = [];
 	if (options.app) {
 		if (!workspace.apps[options.app]) {
@@ -964,25 +1106,23 @@ async function workspaceDevCommand(workspace, options) {
 			throw new Error(`App "${options.app}" not found. Available apps: ${appNames}`);
 		}
 		turboFilter = ["--filter", appPackageName(workspace, options.app) ?? options.app];
-		logger$11.log(`\n🎯 Running single app: ${options.app}`);
-	} else if (options.filter) {
-		turboFilter = ["--filter", options.filter];
-		logger$11.log(`\n🔍 Using filter: ${options.filter}`);
-	} else {
+	} else if (options.filter) turboFilter = ["--filter", options.filter];
+	else {
 		const { filters, unpackaged } = turboFilters(workspace);
 		turboFilter = filters.flatMap((name) => ["--filter", name]);
-		if (unpackaged.length > 0) logger$11.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
-		logger$11.log(`\n🎯 Running all ${appCount} apps`);
+		if (unpackaged.length > 0) logger$10.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
 	}
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	logger$11.log("\n📋 Apps (in dependency order):");
+	const width = Math.max(...buildOrder.map((name) => name.length));
+	logger$10.log(`\n${workspace.name}: ${appCount} app(s)`);
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
-		const deps = app.dependencies.length > 0 ? ` (depends on: ${app.dependencies.join(", ")})` : "";
-		const icon = app.type === "backend" ? "🔧" : app.type === "mobile" ? "📱" : "🌐";
-		logger$11.log(`   ${icon} ${appName} → http://localhost:${app.port}${deps}`);
+		const local = `http://localhost:${app.port}`;
+		const url = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === appName)?.[1];
+		logger$10.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
 	}
+	logger$10.log("");
 	const configFiles = [
 		"gkm.config.ts",
 		"gkm.config.js",
@@ -1013,7 +1153,6 @@ async function workspaceDevCommand(workspace, options) {
 		});
 	}
 	if (held.length > 0) throw new WorkspacePortsInUse(held);
-	logger$11.log("\n🏃 Starting turbo run dev...\n");
 	const turboProcess = (0, node_child_process.spawn)("pnpm", [
 		"turbo",
 		"run",
@@ -1029,7 +1168,7 @@ async function workspaceDevCommand(workspace, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down workspace...");
+		logger$10.log("\n🛑 Shutting down workspace...");
 		const pid = turboProcess.pid;
 		if (pid) try {
 			process.kill(-pid, "SIGTERM");
@@ -1053,7 +1192,7 @@ async function workspaceDevCommand(workspace, options) {
 	process.on("SIGTERM", shutdown);
 	return new Promise((resolve, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$11.error("❌ Turbo error:", error);
+			logger$10.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
@@ -1072,11 +1211,11 @@ async function entryDevCommand(options) {
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_workspace$1.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$11.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$11.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$11.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	if (appName) logger$10.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$10.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$10.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
@@ -1087,7 +1226,7 @@ async function entryDevCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down...");
+		logger$10.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -1123,14 +1262,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$11.log(`📝 File changed: ${path}`);
+				logger$10.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$11.log("🔄 Restarting...");
+					logger$10.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$11.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$10.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -1138,24 +1277,24 @@ var EntryRunner = class {
 			...process.env,
 			PORT: String(this.port)
 		};
-		this.childProcess = (0, node_child_process.spawn)("npx", ["tsx", this.wrapperPath], {
+		this.childProcess = (0, node_child_process.spawn)(...tsxCommand((0, node_path.dirname)(this.wrapperPath), [this.wrapperPath]), {
 			stdio: "inherit",
 			env,
 			detached: true
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$11.error("❌ Process error:", error);
+			logger$10.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$10.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 500));
 		if (this.isRunning) {
-			logger$11.log("");
-			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$11.log("");
+			logger$10.log("");
+			logger$10.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$10.log("");
 		}
 	}
 	async restart() {
@@ -1241,7 +1380,6 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
 const { app } = await import('${appImportPath}');
 
 ${serveCode.replace(/^ {4}/gm, "")}
-console.log(\`Server started on port \${port}\`);
 `;
 	return `#!/usr/bin/env node
 /**
@@ -1270,6 +1408,31 @@ start({
 });
 `;
 }
+/** Run `fn` with `console.log` muted — warnings and errors still print. */
+async function quietly(fn) {
+	const log = console.log;
+	console.log = () => {};
+	try {
+		return await fn();
+	} finally {
+		console.log = log;
+	}
+}
+/**
+* How to run a TypeScript entry with the app's own tsx.
+*
+* Straight through node rather than `npx tsx`: npx reads the developer's npm
+* config on every start and warned about each key it did not recognise — nine
+* lines per app, per restart, about nothing gkm does.
+*/
+function tsxCommand(appRoot, args) {
+	try {
+		const cli = (0, node_module.createRequire)((0, node_path.join)(appRoot, "package.json")).resolve("tsx/cli");
+		return [process.execPath, [cli, ...args]];
+	} catch {
+		return ["npx", ["tsx", ...args]];
+	}
+}
 /** A port this app must serve on is held by something else. */
 var DevPortInUse = class extends Error {
 	port;
@@ -1336,6 +1499,13 @@ var DevServer = class {
 		this.selfServing = selfServing;
 		this.actualPort = requestedPort;
 	}
+	/** What the ready line calls this app. */
+	label = "server";
+	/**
+	* Where the app is reached — its HTTPS address behind the edge, when it has
+	* one. The local port is only what the edge forwards to.
+	*/
+	publicUrl;
 	async start() {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
@@ -1344,17 +1514,15 @@ var DevServer = class {
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await require_workspace$1.findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$11.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			if (this.actualPort !== this.requestedPort) logger$10.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", this.provider, "server.ts");
 		await this.createServerEntry();
-		logger$11.log(`\n⏳ Starting server...`);
-		this.serverProcess = (0, node_child_process.spawn)("npx", [
-			"tsx",
+		this.serverProcess = (0, node_child_process.spawn)(...tsxCommand(this.appRoot, [
 			serverEntryPath,
 			"--port",
 			this.actualPort.toString()
-		], {
+		]), {
 			stdio: "inherit",
 			env: {
 				...process.env,
@@ -1365,29 +1533,24 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$11.error("❌ Server error:", error);
+			logger$10.error("❌ Server error:", error);
 		});
 		this.serverProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$10.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 1e3));
 		if (this.isRunning) {
-			const base = `http://localhost:${this.actualPort}`;
-			const lines = [`  Local:     ${base}`];
-			if (this.enableOpenApi) lines.push(`  API Docs:  ${base}/__docs`);
-			if (this.telescope) lines.push(`  Telescope: ${base}${this.telescope.path}`);
-			if (this.studio) lines.push(`  Studio:    ${base}${this.studio.path}`);
-			const maxLen = Math.max(...lines.map((l) => l.length));
-			const pad = (s) => s.padEnd(maxLen);
-			const border = "─".repeat(maxLen + 2);
-			logger$11.log("");
-			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m in ${((Date.now() - this.startTime) / 1e3).toFixed(1)}s`);
-			logger$11.log("");
-			logger$11.log(`  ┌${border}┐`);
-			for (const line of lines) logger$11.log(`  │ ${pad(line)} │`);
-			logger$11.log(`  └${border}┘`);
-			logger$11.log("");
+			const local = `http://localhost:${this.actualPort}`;
+			const address = this.publicUrl ? `${this.publicUrl} -> ${local}` : local;
+			const seconds = ((Date.now() - this.startTime) / 1e3).toFixed(1);
+			logger$10.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
+			const tools = this.selfServing ? [] : [
+				...this.enableOpenApi ? ["docs /__docs"] : [],
+				...this.telescope ? [`telescope ${this.telescope.path}`] : [],
+				...this.studio ? [`studio ${this.studio.path}`] : []
+			];
+			if (tools.length > 0) logger$10.log(`  ${tools.join(" · ")}`);
 		}
 	}
 	async stop() {
@@ -2202,7 +2365,7 @@ var TopicGenerator = class extends require_discover.ConstructGenerator {
 };
 //#endregion
 //#region src/build/manifests.ts
-const logger$10 = console;
+const logger$9 = console;
 function isPartitioned(field) {
 	return !Array.isArray(field);
 }
@@ -2299,8 +2462,8 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = (0, node_path.join)(manifestDir, "aws.ts");
 	await (0, node_fs_promises.writeFile)(manifestPath, content);
-	logger$10.log(`Generated AWS manifest with ${countItems(awsRoutes)} routes, ${countItems(functions)} functions, ${countItems(crons)} crons, ${countItems(subscribers)} subscribers, ${countItems(queues)} queues, ${countItems(topics)} topics`);
-	logger$10.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
+	logger$9.log(`Generated AWS manifest with ${countItems(awsRoutes)} routes, ${countItems(functions)} functions, ${countItems(crons)} crons, ${countItems(subscribers)} subscribers, ${countItems(queues)} queues, ${countItems(topics)} topics`);
+	logger$9.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
 }
 async function generateServerManifest(outputDir, appInfo, routes, subscribers, queues = [], topics = [], constructs = {}, backends = {}) {
 	const manifestDir = (0, node_path.join)(outputDir, "manifest");
@@ -2355,8 +2518,8 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = (0, node_path.join)(manifestDir, "server.ts");
 	await (0, node_fs_promises.writeFile)(manifestPath, content);
-	logger$10.log(`Generated server manifest with ${countItems(serverRoutes)} routes, ${countItems(serverSubscribers)} subscribers, ${countItems(serverQueues)} queues, ${countItems(serverTopics)} topics`);
-	logger$10.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
+	logger$9.log(`Generated server manifest with ${countItems(serverRoutes)} routes, ${countItems(serverSubscribers)} subscribers, ${countItems(serverQueues)} queues, ${countItems(serverTopics)} topics`);
+	logger$9.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
 }
 /**
 * Filter out 'ALL' method routes from a manifest field (flat or partitioned).
@@ -2561,7 +2724,7 @@ export default app;
 }
 //#endregion
 //#region src/build/index.ts
-const logger$9 = console;
+const logger$8 = console;
 /**
 * What a build run at the workspace root reads.
 *
@@ -2586,7 +2749,7 @@ async function buildCommand(options) {
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
 		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => (0, node_path.resolve)(workspaceRoot, app.path) !== workspaceRoot);
 		if (isAtWorkspaceRoot && someAppIsElsewhere) {
-			logger$9.log("📦 Detected workspace configuration");
+			logger$8.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
@@ -2595,15 +2758,15 @@ async function buildCommand(options) {
 	const cacheBackend = require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(loadedConfig.workspace));
 	const productionConfigFromGkm = getProductionConfigFromGkm(config);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
-	if (production) logger$9.log(`🏭 Building for PRODUCTION`);
-	logger$9.log(`Building with providers: ${resolved.providers.join(", ")}`);
-	logger$9.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
+	if (production) logger$8.log(`🏭 Building for PRODUCTION`);
+	logger$8.log(`Building with providers: ${resolved.providers.join(", ")}`);
+	logger$8.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$9.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$8.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = production ? void 0 : normalizeStudioConfig(config.studio);
-	if (studio) logger$9.log(`🗄️  Studio enabled at ${studio.path}`);
+	if (studio) logger$8.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks);
-	if (hooks) logger$9.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$8.log(`🪝 Server hooks enabled`);
 	return buildApp({
 		config,
 		workspaceRoot: loadedConfig.workspace.root,
@@ -2646,7 +2809,7 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry((0, node_path.join)(appRoot, ".gkm", "server"), selfServing.source);
-		logger$9.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		logger$8.log(`Generated a server for ${selfServing.id} from its own declaration`);
 		return { selfServing: selfServing.id };
 	}
 	const derived = ownersContext({
@@ -2686,14 +2849,14 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
-	logger$9.log(`Found ${allEndpoints.length} endpoints`);
-	logger$9.log(`Found ${allFunctions.length} functions`);
-	logger$9.log(`Found ${allCrons.length} crons`);
-	logger$9.log(`Found ${allSubscribers.length} subscribers`);
-	logger$9.log(`Found ${allQueues.length} queues`);
-	logger$9.log(`Found ${allTopics.length} topics`);
+	logger$8.log(`Found ${allEndpoints.length} endpoints`);
+	logger$8.log(`Found ${allFunctions.length} functions`);
+	logger$8.log(`Found ${allCrons.length} crons`);
+	logger$8.log(`Found ${allSubscribers.length} subscribers`);
+	logger$8.log(`Found ${allQueues.length} queues`);
+	logger$8.log(`Found ${allTopics.length} topics`);
 	if (!input.serveEmpty && allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		logger$9.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
+		logger$8.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
 	const rootOutputDir = (0, node_path.join)(appRoot, ".gkm");
@@ -2710,7 +2873,7 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 	const rootOutputDir = (0, node_path.join)(appRoot, ".gkm");
 	const outputDir = (0, node_path.join)(rootOutputDir, provider);
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
-	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
+	logger$8.log(`\nGenerating handlers for provider: ${provider}`);
 	const [routes, functionInfos, cronInfos, subscriberInfos, queueInfos, topicInfos] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
@@ -2722,7 +2885,7 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 		queueGenerator.build(context, queues, outputDir, { provider }),
 		topicGenerator.build(context, topics, outputDir, { provider })
 	]);
-	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${provider}`);
+	logger$8.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
 	const manifestCrons = assembleManifestField(cronInfos, crons);
@@ -2742,8 +2905,8 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 		}, serverRouteField, manifestSubscribers, manifestQueues, manifestTopics);
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
-			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-mjqGAvu1.cjs"));
+			logger$8.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CYF5mWi9.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2760,10 +2923,10 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 				stage,
 				constructs: allConstructs
 			})).masterKey;
-			logger$9.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$8.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
-				logger$9.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$9.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
+				logger$8.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$8.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
 			}
 		}
 		return { masterKey };
@@ -2850,19 +3013,19 @@ async function workspaceBuildCommand(workspace, options) {
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
 	const frontendApps = apps.filter(([, app]) => app.type === "web");
-	logger$9.log(`\n🏗️  Building workspace: ${workspace.name}`);
-	logger$9.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
-	logger$9.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
-	if (options.production) logger$9.log(`   🏭 Production mode enabled`);
+	logger$8.log(`\n🏗️  Building workspace: ${workspace.name}`);
+	logger$8.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
+	logger$8.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
+	if (options.production) logger$8.log(`   🏭 Production mode enabled`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	logger$9.log(`   Build order: ${buildOrder.join(" → ")}`);
+	logger$8.log(`   Build order: ${buildOrder.join(" → ")}`);
 	const pm = detectPackageManager$2();
-	logger$9.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
+	logger$8.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
 	try {
 		const { filters, unpackaged } = turboFilters(workspace);
 		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
 		const turboCommand = getTurboCommand(pm, filters);
-		logger$9.log(`Running: ${turboCommand}`);
+		logger$8.log(`Running: ${turboCommand}`);
 		await new Promise((resolve, reject) => {
 			const child = (0, node_child_process.spawn)(turboCommand, {
 				shell: true,
@@ -2890,15 +3053,15 @@ async function workspaceBuildCommand(workspace, options) {
 				outputPath
 			});
 		}
-		logger$9.log(`\n✅ Workspace build complete!`);
-		logger$9.log(`\n📋 Build Summary:`);
+		logger$8.log(`\n✅ Workspace build complete!`);
+		logger$8.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-			logger$9.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
+			logger$8.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : "Build failed";
-		logger$9.log(`\n❌ Build failed: ${errorMessage}`);
+		logger$8.log(`\n❌ Build failed: ${errorMessage}`);
 		for (const [appName, app] of apps) results.push({
 			appName,
 			type: app.type,
@@ -3782,7 +3945,7 @@ async function createDnsProvider(options) {
 *
 * Handles automatic DNS record creation for deployed applications.
 */
-const logger$8 = console;
+const logger$7 = console;
 /**
 * Check if DNS config is legacy format (single domain with `domain` property)
 */
@@ -3819,7 +3982,7 @@ function groupHostnamesByDomain(appHostnames, dnsConfig) {
 	for (const [appName, hostname] of appHostnames) {
 		const rootDomain = findRootDomain(hostname, dnsConfig);
 		if (!rootDomain) {
-			logger$8.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			logger$7.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
 			continue;
 		}
 		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
@@ -3869,10 +4032,10 @@ function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
 * Print DNS records table
 */
 function printDnsRecordsTable(records, rootDomain) {
-	logger$8.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$8.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$8.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$8.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	logger$7.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$7.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$7.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$7.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
 	for (const record of records) {
 		const subdomain = record.subdomain.padEnd(35);
 		const type = record.type.padEnd(4);
@@ -3882,18 +4045,18 @@ function printDnsRecordsTable(records, rootDomain) {
 		else if (record.created) status = "✓ new";
 		else if (record.existed) status = "✓";
 		else status = "?";
-		logger$8.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+		logger$7.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	logger$8.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+	logger$7.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
 * Print DNS records in a simple format for manual setup
 */
 function printDnsRecordsSimple(records, rootDomain) {
-	logger$8.log("\n   📋 Required DNS Records:");
-	logger$8.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$8.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$8.log("");
+	logger$7.log("\n   📋 Required DNS Records:");
+	logger$7.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$7.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$7.log("");
 }
 /**
 * Create DNS records for a single domain using its configured provider
@@ -3905,7 +4068,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		provider = await createDnsProvider({ config: providerConfig });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$8.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		logger$7.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			...r,
 			error: message
@@ -3959,7 +4122,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$8.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		logger$7.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			hostname: r.hostname,
 			subdomain: r.subdomain,
@@ -3986,20 +4149,20 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$8.log("\n🌐 Setting up DNS records...");
+	logger$7.log("\n🌐 Setting up DNS records...");
 	let serverIp;
 	try {
 		const endpointUrl = new URL(dokployEndpoint);
 		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$8.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+		logger$7.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$8.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		logger$7.log(`   ⚠ Failed to resolve server IP: ${message}`);
 		return null;
 	}
 	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
 	if (groupedHostnames.size === 0) {
-		logger$8.log("   No DNS records needed (no hostnames match configured domains)");
+		logger$7.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
 			records: [],
 			success: true,
@@ -4011,22 +4174,22 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	for (const [rootDomain, domainHostnames] of groupedHostnames) {
 		const providerConfig = normalizedConfig[rootDomain];
 		if (!providerConfig) {
-			logger$8.log(`   ⚠ No provider config for ${rootDomain}`);
+			logger$7.log(`   ⚠ No provider config for ${rootDomain}`);
 			continue;
 		}
 		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
 		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
 		if (requiredRecords.length === 0) continue;
-		logger$8.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		logger$7.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
 		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
 		allRecords.push(...domainRecords);
 		const created = domainRecords.filter((r) => r.created).length;
 		const existed = domainRecords.filter((r) => r.existed).length;
 		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$8.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$8.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (created > 0) logger$7.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$7.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
 		if (failed > 0) {
-			logger$8.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			logger$7.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
 		if (state) {
@@ -4063,10 +4226,10 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 */
 async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
-	logger$8.log("\n🔍 Verifying DNS records...");
+	logger$7.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
 		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$8.log(`   ✓ ${hostname} (previously verified)`);
+			logger$7.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
 				appName,
@@ -4080,7 +4243,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
 				setDnsVerification(state, hostname, serverIp);
-				logger$8.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				logger$7.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -4089,7 +4252,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 					expectedIp: serverIp
 				});
 			} else {
-				logger$8.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				logger$7.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -4100,7 +4263,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$8.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			logger$7.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
 			results.push({
 				hostname,
 				appName,
@@ -4114,9 +4277,9 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const skipped = results.filter((r) => r.skipped).length;
 	const pending = results.filter((r) => !r.verified).length;
 	if (pending > 0) {
-		logger$8.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$8.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$8.log(`   ${verified} verified (${skipped} from cache)`);
+		logger$7.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$7.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$7.log(`   ${verified} verified (${skipped} from cache)`);
 	return results;
 }
 //#endregion
@@ -4149,43 +4312,19 @@ function resolveHost(appName, app, stage, dokployConfig, isMainFrontend) {
 	return `${appName}.${baseDomain}`;
 }
 /**
-* Which site the base domain points at.
-*
-* Three rules, in order, and the last one is the point:
-*
-* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
-* 2. **Named `web`** — the convention wins, because people already rely on it.
-* 3. **Declared `root: true`** — the site says so itself.
-*
-* Anything else throws. It used to take the *first* `type: 'web'` it iterated,
-* and that object is built from the manifest, which is built in glob traversal
-* order — so two sites with neither named `web` meant renaming a file could
-* move the production root domain, silently. The same shape as
-* `CacheIsAmbiguous`: unambiguous with one and arbitrary with two, so two is an
-* error rather than a coin toss.
+* Whether this app is the site the base domain points at — see `rootSite`,
+* which the local edge asks too.
 *
 * @throws {AmbiguousRootSite} when several sites could be the root and none says it is
 */
 function isMainFrontendApp(appName, app, allApps) {
 	if (app.type !== "web") return false;
-	const sites = Object.entries(allApps).filter(([, a]) => a.type === "web");
-	if (sites.length === 1) return true;
-	if (sites.filter(([name]) => name === "web").length > 0) return appName === "web";
-	const declared = sites.filter(([, a]) => a.root === true);
-	if (declared.length === 1) return declared[0][0] === appName;
-	throw new AmbiguousRootSite(sites.map(([name]) => name), declared.length > 1);
-}
-/** Several sites could hold the base domain, and none of them says it does. */
-var AmbiguousRootSite = class extends Error {
-	sites;
-	tooMany;
-	constructor(sites, tooMany = false) {
-		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a production hostname.`);
-		this.sites = sites;
-		this.tooMany = tooMany;
-		this.name = "AmbiguousRootSite";
-	}
-};
+	const sites = Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
+		name,
+		root: a.root
+	}));
+	return require_workspace$1.rootSite(sites) === appName;
+}
 /**
 * Get public URL arg names from app dependencies.
 *
@@ -5048,7 +5187,7 @@ CMD ["nginx", "-g", "daemon off;"]
 }
 //#endregion
 //#region src/docker/index.ts
-const logger$7 = console;
+const logger$6 = console;
 /**
 * Docker command implementation
 * Generates Dockerfile, docker-compose.yml, and related files
@@ -5059,7 +5198,7 @@ const logger$7 = console;
 async function dockerCommand(options) {
 	const loadedConfig = await require_config.loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$7.log("📦 Detected workspace configuration");
+		logger$6.log("📦 Detected workspace configuration");
 		return workspaceDockerCommand(loadedConfig.workspace);
 	}
 	const config = await require_config.loadConfig();
@@ -5079,7 +5218,7 @@ async function dockerCommand(options) {
 	if (inMonorepo && !useSlim) {
 		if (hasTurbo) {
 			useTurbo = true;
-			logger$7.log("   Detected monorepo with turbo.json - using turbo prune");
+			logger$6.log("   Detected monorepo with turbo.json - using turbo prune");
 		} else throw new Error("Monorepo detected but turbo.json not found.\n\nDocker builds in monorepos require Turborepo for proper dependency isolation.\n\nTo fix this:\n  1. Install turbo: pnpm add -Dw turbo\n  2. Create turbo.json in your monorepo root\n  3. Run this command again\n\nSee: https://turbo.build/repo/docs/guides/tools/docker");
 	}
 	let turboPackage = options.turboPackage ?? dockerConfig.imageName;
@@ -5087,7 +5226,7 @@ async function dockerCommand(options) {
 		const pkg = require(`${process.cwd()}/package.json`);
 		if (pkg.name) {
 			turboPackage = pkg.name;
-			logger$7.log(`   Turbo package: ${turboPackage}`);
+			logger$6.log(`   Turbo package: ${turboPackage}`);
 		}
 	} catch {}
 	const templateOptions = {
@@ -5104,16 +5243,16 @@ async function dockerCommand(options) {
 	const dockerMode = useSlim ? "slim" : useTurbo ? "turbo" : "multi-stage";
 	const dockerfilePath = (0, node_path.join)(dockerDir, "Dockerfile");
 	await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-	logger$7.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
+	logger$6.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
 	const composePath = await writeConstructsCompose(loadedConfig.workspace);
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = (0, node_path.join)(process.cwd(), ".dockerignore");
 	await (0, node_fs_promises.writeFile)(dockerignorePath, dockerignore);
-	logger$7.log("Generated: .dockerignore (project root)");
+	logger$6.log("Generated: .dockerignore (project root)");
 	const entrypoint = generateDockerEntrypoint();
 	const entrypointPath = (0, node_path.join)(dockerDir, "docker-entrypoint.sh");
 	await (0, node_fs_promises.writeFile)(entrypointPath, entrypoint);
-	logger$7.log("Generated: .gkm/docker/docker-entrypoint.sh");
+	logger$6.log("Generated: .gkm/docker/docker-entrypoint.sh");
 	const result = {
 		dockerfile: dockerfilePath,
 		dockerCompose: composePath,
@@ -5132,13 +5271,13 @@ async function dockerCommand(options) {
 function ensureLockfile(cwd) {
 	const lockfilePath = findLockfilePath(cwd);
 	if (!lockfilePath) {
-		logger$7.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
+		logger$6.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
 		return null;
 	}
 	const lockfileName = (0, node_path.basename)(lockfilePath);
 	const localLockfile = (0, node_path.join)(cwd, lockfileName);
 	if (lockfilePath === localLockfile) return null;
-	logger$7.log(`   Copying ${lockfileName} from monorepo root...`);
+	logger$6.log(`   Copying ${lockfileName} from monorepo root...`);
 	(0, node_fs.copyFileSync)(lockfilePath, localLockfile);
 	return () => {
 		try {
@@ -5154,7 +5293,7 @@ async function buildDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
-	logger$7.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger$6.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cwd = process.cwd();
 	const cleanup = ensureLockfile(cwd);
 	try {
@@ -5166,7 +5305,7 @@ async function buildDockerImage(imageName, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$7.log(`✅ Docker image built: ${fullImageName}`);
+		logger$6.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	} finally {
@@ -5181,13 +5320,13 @@ async function pushDockerImage(imageName, options) {
 	const registry = options.registry;
 	if (!registry) throw new Error("Registry is required to push Docker image. Use --registry or configure docker.registry in gkm.config.ts");
 	const fullImageName = `${registry}/${imageName}:${tag}`;
-	logger$7.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger$6.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		(0, node_child_process.execSync)(`docker push ${fullImageName}`, {
 			cwd: process.cwd(),
 			stdio: "inherit"
 		});
-		logger$7.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger$6.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -5212,21 +5351,21 @@ function getAppPackageName(appPath) {
 async function workspaceDockerCommand(workspace) {
 	const results = [];
 	const apps = Object.entries(workspace.apps);
-	logger$7.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger$6.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
 	const dockerDir = (0, node_path.join)(workspace.root, ".gkm", "docker");
 	await (0, node_fs_promises.mkdir)(dockerDir, { recursive: true });
 	const packageManager = detectPackageManager$1(workspace.root);
-	logger$7.log(`   Package manager: ${packageManager}`);
+	logger$6.log(`   Package manager: ${packageManager}`);
 	for (const [appName, app] of apps) {
 		if (app.type === "mobile") {
-			logger$7.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger$6.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
 		const appPath = app.path;
 		const turboPackage = getAppPackageName((0, node_path.join)(workspace.root, appPath)) ?? appName;
 		const imageName = appName;
 		const buildType = !!app.entry ? "entry" : app.type;
-		logger$7.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger$6.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		let dockerfile;
 		if (app.type === "web") {
 			const publicUrlArgs = getPublicUrlArgNames(app);
@@ -5270,7 +5409,7 @@ async function workspaceDockerCommand(workspace) {
 		});
 		const dockerfilePath = (0, node_path.join)(dockerDir, `Dockerfile.${appName}`);
 		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-		logger$7.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
+		logger$6.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -5281,13 +5420,13 @@ async function workspaceDockerCommand(workspace) {
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = (0, node_path.join)(workspace.root, ".dockerignore");
 	await (0, node_fs_promises.writeFile)(dockerignorePath, dockerignore);
-	logger$7.log(`\n   Generated: .dockerignore (workspace root)`);
+	logger$6.log(`\n   Generated: .dockerignore (workspace root)`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger$7.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${require_workspace$1.COMPOSE_PATH}`);
-	logger$7.log("\n📋 Build commands:");
+	logger$6.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${require_workspace$1.COMPOSE_PATH}`);
+	logger$6.log("\n📋 Build commands:");
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger$7.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
+		logger$6.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
 	}
 	printRunInstructions(workspace);
 	return {
@@ -5308,18 +5447,18 @@ async function writeConstructsCompose(workspace) {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger$7.log(`   Generated: ${require_workspace$1.COMPOSE_PATH} (project root)`);
+	logger$6.log(`   Generated: ${require_workspace$1.COMPOSE_PATH} (project root)`);
 	return (0, node_path.join)(workspace.root, require_workspace$1.COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = (0, node_fs.existsSync)((0, node_path.join)(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger$7.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger$7.log("   gkm setup   # starts the containers and creates what they hold");
-	logger$7.log(`   docker compose -f ${require_workspace$1.COMPOSE_PATH}${project} --profile apps up --build`);
+	logger$6.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger$6.log("   gkm setup   # starts the containers and creates what they hold");
+	logger$6.log(`   docker compose -f ${require_workspace$1.COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/deploy/docker.ts
-const logger$6 = console;
+const logger$5 = console;
 /**
 * Get the full image reference
 */
@@ -5334,9 +5473,9 @@ function getImageRef(registry, imageName, tag) {
 * @param buildArgs - Build arguments to pass to docker build
 */
 async function buildImage(imageRef, _appName, buildArgs) {
-	logger$6.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$5.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
-	logger$6.log("   Generating Dockerfile for the pre-built bundle...");
+	logger$5.log("   Generating Dockerfile for the pre-built bundle...");
 	await dockerCommand({ slim: true });
 	const dockerfilePath = (0, node_path.join)(cwd, ".gkm", "docker", "Dockerfile");
 	const buildCwd = cwd;
@@ -5358,7 +5497,7 @@ async function buildImage(imageRef, _appName, buildArgs) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$6.log(`✅ Image built: ${imageRef}`);
+		logger$5.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
 		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -5367,13 +5506,13 @@ async function buildImage(imageRef, _appName, buildArgs) {
 * Push Docker image to registry
 */
 async function pushImage(imageRef) {
-	logger$6.log(`\n☁️  Pushing image: ${imageRef}`);
+	logger$5.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
 		(0, node_child_process.execSync)(`docker push ${imageRef}`, {
 			cwd: process.cwd(),
 			stdio: "inherit"
 		});
-		logger$6.log(`✅ Image pushed: ${imageRef}`);
+		logger$5.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
 		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -5387,18 +5526,18 @@ async function deployDocker(options) {
 	const imageRef = getImageRef(config.registry, imageName, tag);
 	await buildImage(imageRef, config.appName, buildArgs);
 	if (!skipPush) {
-		if (!config.registry) logger$6.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		if (!config.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 		else await pushImage(imageRef);
 	}
-	logger$6.log("\n✅ Docker deployment ready!");
-	logger$6.log(`\n📋 Deployment details:`);
-	logger$6.log(`   Image: ${imageRef}`);
-	logger$6.log(`   Stage: ${stage}`);
+	logger$5.log("\n✅ Docker deployment ready!");
+	logger$5.log(`\n📋 Deployment details:`);
+	logger$5.log(`   Image: ${imageRef}`);
+	logger$5.log(`   Stage: ${stage}`);
 	if (masterKey) {
-		logger$6.log(`\n🔐 Deploy with this environment variable:`);
-		logger$6.log(`   GKM_MASTER_KEY=${masterKey}`);
-		logger$6.log("\n   Example docker run:");
-		logger$6.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
+		logger$5.log(`\n🔐 Deploy with this environment variable:`);
+		logger$5.log(`   GKM_MASTER_KEY=${masterKey}`);
+		logger$5.log("\n   Example docker run:");
+		logger$5.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
 	}
 	return {
 		imageRef,
@@ -6777,7 +6916,7 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 *
 * @module deploy
 */
-const logger$5 = console;
+const logger$4 = console;
 /**
 * Prompt for input
 */
@@ -6851,7 +6990,7 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 		return;
 	} catch {
 		if (i < maxRetries - 1) {
-			logger$5.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			logger$4.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
 			await new Promise((r) => setTimeout(r, retryIntervalMs));
 		}
 	}
@@ -6894,10 +7033,10 @@ async function applyDeclaredStatements(api, postgres, serverHostname, statements
 			break;
 		} catch (error) {
 			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
-			logger$5.log(`   Port ${candidate} is taken; trying another...`);
+			logger$4.log(`   Port ${candidate} is taken; trying another...`);
 		}
 		if (externalPort === void 0) throw new Error(`Could not publish a port for ${postgres.appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
-		logger$5.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
+		logger$4.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
 	}
 	await api.deployPostgres(postgres.postgresId);
 	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
@@ -6921,7 +7060,7 @@ async function applyDeclaredStatements(api, postgres, serverHostname, statements
 	const unpublish = async () => {
 		if (!opened) return;
 		await api.savePostgresExternalPort(postgres.postgresId, null).then(() => api.deployPostgres(postgres.postgresId)).catch(() => {
-			logger$5.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
+			logger$4.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
 		});
 	};
 	let lastError;
@@ -6932,7 +7071,7 @@ async function applyDeclaredStatements(api, postgres, serverHostname, statements
 			lastError = error;
 			if (attempt === 3) break;
 			const message = error instanceof Error ? error.message : String(error);
-			logger$5.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+			logger$4.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
 			await new Promise((resolve) => setTimeout(resolve, 1e4));
 			await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName).catch(() => {});
 		}
@@ -7007,91 +7146,91 @@ async function workspaceDeployCommand(configured, options) {
 		apps: units
 	} : configured;
 	if (provider !== "dokploy") throw new Error(`Workspace deployment only supports Dokploy. Got: ${provider}`);
-	logger$5.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
-	logger$5.log(`   Stage: ${stage}`);
+	logger$4.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
+	logger$4.log(`   Stage: ${stage}`);
 	const imageTag = tag ?? generateTag(stage);
-	logger$5.log(`   Tag: ${imageTag}`);
+	logger$4.log(`   Tag: ${imageTag}`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	let appsToDeployNames = buildOrder;
 	if (selectedApps && selectedApps.length > 0) {
 		const invalidApps = selectedApps.filter((name) => !workspace.apps[name]);
 		if (invalidApps.length > 0) throw new Error(`Unknown apps: ${invalidApps.join(", ")}\nAvailable apps: ${Object.keys(workspace.apps).join(", ")}`);
 		appsToDeployNames = buildOrder.filter((name) => selectedApps.includes(name));
-		logger$5.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
-	} else logger$5.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
+		logger$4.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
+	} else logger$4.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
 	const dokployApps = appsToDeployNames.filter((name) => {
 		const target = workspace.apps[name].resolvedDeployTarget;
 		if (!require_workspace.isDeployTargetSupported(target)) {
-			logger$5.log(`   ⚠️  Skipping ${name}: ${require_workspace.getDeployTargetError(target, name)}`);
+			logger$4.log(`   ⚠️  Skipping ${name}: ${require_workspace.getDeployTargetError(target, name)}`);
 			return false;
 		}
 		return true;
 	});
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
-	logger$5.log("\n🔐 Loading secrets and analyzing environment requirements...");
+	logger$4.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const stageSecrets = await require_storage.readStageSecrets(stage, workspace.root);
 	if (!stageSecrets) {
-		logger$5.log(`   ⚠️  No secrets found for stage "${stage}"`);
-		logger$5.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
+		logger$4.log(`   ⚠️  No secrets found for stage "${stage}"`);
+		logger$4.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
 	}
 	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
 	if (stageSecrets) {
 		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
-		if (report.appsWithSecrets.length > 0) logger$5.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
-		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger$5.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
+		if (report.appsWithSecrets.length > 0) logger$4.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
+		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger$4.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
 	}
 	let creds = await getDokployCredentials();
 	if (!creds) {
-		logger$5.log("\n📋 Dokploy credentials not found. Let's set them up.");
+		logger$4.log("\n📋 Dokploy credentials not found. Let's set them up.");
 		const normalizedEndpoint = (await prompt("Dokploy URL (e.g., https://dokploy.example.com): ")).replace(/\/$/, "");
 		try {
 			new URL(normalizedEndpoint);
 		} catch {
 			throw new Error("Invalid URL format");
 		}
-		logger$5.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
+		logger$4.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
 		const token = await prompt("API Token: ", true);
-		logger$5.log("\nValidating credentials...");
+		logger$4.log("\nValidating credentials...");
 		if (!await validateDokployToken(normalizedEndpoint, token)) throw new Error("Invalid credentials. Please check your token.");
 		await storeDokployCredentials(token, normalizedEndpoint);
 		creds = {
 			token,
 			endpoint: normalizedEndpoint
 		};
-		logger$5.log("✓ Credentials saved");
+		logger$4.log("✓ Credentials saved");
 	}
 	const api = new DokployApi({
 		baseUrl: creds.endpoint,
 		token: creds.token
 	});
-	logger$5.log("\n📁 Setting up Dokploy project...");
+	logger$4.log("\n📁 Setting up Dokploy project...");
 	const projectName = workspace.name;
 	let project = (await api.listProjects()).find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 	let environmentId;
 	if (project) {
-		logger$5.log(`   Found existing project: ${project.name}`);
+		logger$4.log(`   Found existing project: ${project.name}`);
 		const matchingEnv = ((await api.getProject(project.projectId)).environments ?? []).find((e) => e.name.toLowerCase() === stage.toLowerCase());
 		if (matchingEnv) {
 			environmentId = matchingEnv.environmentId;
-			logger$5.log(`   Using environment: ${matchingEnv.name}`);
+			logger$4.log(`   Using environment: ${matchingEnv.name}`);
 		} else {
-			logger$5.log(`   Creating "${stage}" environment...`);
+			logger$4.log(`   Creating "${stage}" environment...`);
 			environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
-			logger$5.log(`   ✓ Created environment: ${stage}`);
+			logger$4.log(`   ✓ Created environment: ${stage}`);
 		}
 	} else {
-		logger$5.log(`   Creating project: ${projectName}`);
+		logger$4.log(`   Creating project: ${projectName}`);
 		const result = await api.createProject(projectName);
 		project = result.project;
 		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
-			logger$5.log(`   Creating "${stage}" environment...`);
+			logger$4.log(`   Creating "${stage}" environment...`);
 			environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
 		} else environmentId = result.environment.environmentId;
-		logger$5.log(`   ✓ Created project: ${project.projectId}`);
+		logger$4.log(`   ✓ Created project: ${project.projectId}`);
 	}
-	logger$5.log("\n📋 Loading deploy state...");
+	logger$4.log("\n📋 Loading deploy state...");
 	const stateProvider = await createStateProvider({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
@@ -7099,27 +7238,27 @@ async function workspaceDeployCommand(configured, options) {
 	});
 	let state = await stateProvider.read(stage);
 	if (state) {
-		logger$5.log(`   Found existing state for stage "${stage}"`);
+		logger$4.log(`   Found existing state for stage "${stage}"`);
 		if (state.projectId !== project.projectId) {
-			logger$5.log(`   ⚠ Project ID changed, updating state`);
+			logger$4.log(`   ⚠ Project ID changed, updating state`);
 			state.projectId = project.projectId;
 		}
 		if (state.environmentId !== environmentId) {
-			logger$5.log(`   ⚠ Environment ID changed, updating state`);
+			logger$4.log(`   ⚠ Environment ID changed, updating state`);
 			state.environmentId = environmentId;
 		}
 	} else {
-		logger$5.log(`   Creating new state for stage "${stage}"`);
+		logger$4.log(`   Creating new state for stage "${stage}"`);
 		state = createEmptyState(stage, project.projectId, environmentId);
 	}
-	logger$5.log("\n🐳 Checking registry...");
+	logger$4.log("\n🐳 Checking registry...");
 	let registryId = await getDokployRegistryId();
 	const registry = workspace.deploy.dokploy?.registry;
 	if (registryId) try {
 		const reg = await api.getRegistry(registryId);
-		logger$5.log(`   Using registry: ${reg.registryName}`);
+		logger$4.log(`   Using registry: ${reg.registryName}`);
 	} catch {
-		logger$5.log("   ⚠ Stored registry not found, clearing...");
+		logger$4.log("   ⚠ Stored registry not found, clearing...");
 		registryId = void 0;
 		await storeDokployRegistryId("");
 	}
@@ -7128,26 +7267,26 @@ async function workspaceDeployCommand(configured, options) {
 		if (registries.length > 0) {
 			registryId = registries[0].registryId;
 			await storeDokployRegistryId(registryId);
-			logger$5.log(`   Using registry: ${registries[0].registryName}`);
+			logger$4.log(`   Using registry: ${registries[0].registryName}`);
 		} else if (registry) {
-			logger$5.log("   No registries found in Dokploy. Let's create one.");
-			logger$5.log(`   Registry URL: ${registry}`);
+			logger$4.log("   No registries found in Dokploy. Let's create one.");
+			logger$4.log(`   Registry URL: ${registry}`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
 			registryId = (await api.createRegistry("Default Registry", registry, username, password)).registryId;
 			await storeDokployRegistryId(registryId);
-			logger$5.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$5.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
+			logger$4.log(`   ✓ Registry created: ${registryId}`);
+		} else logger$4.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
 	}
 	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
-	if (skippedMobileApps.length > 0) logger$5.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
+	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const dokployConfig = workspace.deploy.dokploy;
 	let declaredEnv = {};
 	let declaredClusters = {};
 	{
-		logger$5.log("\n📦 Provisioning declared constructs...");
+		logger$4.log("\n📦 Provisioning declared constructs...");
 		const appUrls = {};
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
@@ -7165,20 +7304,20 @@ async function workspaceDeployCommand(configured, options) {
 		});
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
-		if (Object.keys(declaredEnv).length > 0) logger$5.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
+		if (Object.keys(declaredEnv).length > 0) logger$4.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
 		if (declared.statements.length > 0) {
 			const serverHostname = getServerHostname(creds.endpoint);
 			for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
 				const statements = declared.statements.filter((statement) => statement.database === databaseName);
 				if (statements.length === 0) continue;
 				const created = await applyDeclaredStatements(api, cluster, serverHostname, statements);
-				logger$5.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+				logger$4.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
 			}
 		}
 	}
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
-		logger$5.log("\n💾 Provisioning backup destination...");
+		logger$4.log("\n💾 Provisioning backup destination...");
 		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-BmhIO_Yr.cjs"));
 		const backupState = await provisionBackupDestination({
 			api,
@@ -7187,13 +7326,13 @@ async function workspaceDeployCommand(configured, options) {
 			stage,
 			config: workspace.deploy.backups,
 			existingState: getBackupState(state),
-			logger: logger$5
+			logger: logger$4
 		});
 		setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
-			logger$5.log("   Creating postgres backup schedule...");
+			logger$4.log("   Creating postgres backup schedule...");
 			const backup = await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
@@ -7204,8 +7343,8 @@ async function workspaceDeployCommand(configured, options) {
 				keepLatestCount: backupRetention
 			});
 			setPostgresBackupId(state, backup.backupId);
-			logger$5.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
-		} else logger$5.log("   ✓ Using existing postgres backup schedule");
+			logger$4.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger$4.log("   ✓ Using existing postgres backup schedule");
 	}
 	const publicUrls = {};
 	const results = [];
@@ -7218,25 +7357,25 @@ async function workspaceDeployCommand(configured, options) {
 		frontendUrls.push(`https://${hostname}`);
 	}
 	if (backendApps.length > 0) {
-		logger$5.log("\n📦 PHASE 1: Deploying backend applications...");
+		logger$4.log("\n📦 PHASE 1: Deploying backend applications...");
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
-			logger$5.log(`\n   ⚙️  Deploying ${appName}...`);
+			logger$4.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
 				const dokployAppName = applicationName(stage, workspace.name, appName);
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
-					logger$5.log(`      Using cached ID: ${cachedAppId}`);
+					logger$4.log(`      Using cached ID: ${cachedAppId}`);
 					application = await api.getApplication(cachedAppId);
-					if (application) logger$5.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$5.log(`      ⚠ Cached ID invalid, will create new`);
+					if (application) logger$4.log(`      ✓ Application found: ${application.applicationId}`);
+					else logger$4.log(`      ⚠ Cached ID invalid, will create new`);
 				}
 				if (!application) {
 					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
 					application = result.application;
-					if (result.created) logger$5.log(`      Created application: ${application.applicationId}`);
-					else logger$5.log(`      Found existing application: ${application.applicationId}`);
+					if (result.created) logger$4.log(`      Created application: ${application.applicationId}`);
+					else logger$4.log(`      Found existing application: ${application.applicationId}`);
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const appSecrets = encryptedSecrets.get(appName);
@@ -7244,11 +7383,11 @@ async function workspaceDeployCommand(configured, options) {
 				if (appSecrets && appSecrets.secretCount > 0) {
 					buildArgs.push(`GKM_ENCRYPTED_CREDENTIALS=${appSecrets.payload.encrypted}`);
 					buildArgs.push(`GKM_CREDENTIALS_IV=${appSecrets.payload.iv}`);
-					logger$5.log(`      Encrypted ${appSecrets.secretCount} secrets`);
+					logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				}
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$5.log(`      Building Docker image: ${imageRef}`);
+				logger$4.log(`      Building Docker image: ${imageRef}`);
 				await deployDocker({
 					stage,
 					tag: imageTag,
@@ -7289,17 +7428,17 @@ async function workspaceDeployCommand(configured, options) {
 					...declaredEnv
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
-				if (Object.keys(withDeclared).length > 0) logger$5.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
+				if (Object.keys(withDeclared).length > 0) logger$4.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
 				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger$5.log(`      Deploying to Dokploy...`);
+				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
 				const existingDomain = (await api.getDomainsByApplicationId(application.applicationId)).find((d) => d.host === backendHost);
 				if (existingDomain) {
 					appHostnames.set(appName, backendHost);
 					appDomainIds.set(appName, existingDomain.domainId);
 					publicUrls[appName] = `https://${backendHost}`;
-					logger$5.log(`      ✓ Domain: https://${backendHost} (existing)`);
+					logger$4.log(`      ✓ Domain: https://${backendHost} (existing)`);
 				} else try {
 					const domain = await api.createDomain({
 						host: backendHost,
@@ -7311,10 +7450,10 @@ async function workspaceDeployCommand(configured, options) {
 					appHostnames.set(appName, backendHost);
 					appDomainIds.set(appName, domain.domainId);
 					publicUrls[appName] = `https://${backendHost}`;
-					logger$5.log(`      ✓ Domain: https://${backendHost} (created)`);
+					logger$4.log(`      ✓ Domain: https://${backendHost} (created)`);
 				} catch (domainError) {
 					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$5.log(`      ⚠ Domain creation failed: ${message}`);
+					logger$4.log(`      ⚠ Domain creation failed: ${message}`);
 					appHostnames.set(appName, backendHost);
 					publicUrls[appName] = `https://${backendHost}`;
 				}
@@ -7325,10 +7464,10 @@ async function workspaceDeployCommand(configured, options) {
 					applicationId: application.applicationId,
 					imageRef
 				});
-				logger$5.log(`      ✓ ${appName} deployed successfully`);
+				logger$4.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : "Unknown error";
-				logger$5.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+				logger$4.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 				results.push({
 					appName,
 					type: app.type,
@@ -7340,25 +7479,25 @@ async function workspaceDeployCommand(configured, options) {
 		}
 	}
 	if (frontendApps.length > 0) {
-		logger$5.log("\n🌐 PHASE 2: Deploying frontend applications...");
+		logger$4.log("\n🌐 PHASE 2: Deploying frontend applications...");
 		for (const appName of frontendApps) {
 			const app = workspace.apps[appName];
-			logger$5.log(`\n   🌐 Deploying ${appName}...`);
+			logger$4.log(`\n   🌐 Deploying ${appName}...`);
 			try {
 				const dokployAppName = applicationName(stage, workspace.name, appName);
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
-					logger$5.log(`      Using cached ID: ${cachedAppId}`);
+					logger$4.log(`      Using cached ID: ${cachedAppId}`);
 					application = await api.getApplication(cachedAppId);
-					if (application) logger$5.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$5.log(`      ⚠ Cached ID invalid, will create new`);
+					if (application) logger$4.log(`      ✓ Application found: ${application.applicationId}`);
+					else logger$4.log(`      ⚠ Cached ID invalid, will create new`);
 				}
 				if (!application) {
 					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
 					application = result.application;
-					if (result.created) logger$5.log(`      Created application: ${application.applicationId}`);
-					else logger$5.log(`      Found existing application: ${application.applicationId}`);
+					if (result.created) logger$4.log(`      Created application: ${application.applicationId}`);
+					else logger$4.log(`      Found existing application: ${application.applicationId}`);
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const dependencyUrls = {};
@@ -7378,7 +7517,7 @@ async function workspaceDeployCommand(configured, options) {
 				};
 				const { valid, missing, resolved } = validateEnvVars(requiredOf(sniffedApps.get(appName)), envContext);
 				if (!valid) throw new Error(formatMissingVarsError(appName, missing, stage));
-				if (Object.keys(resolved).length > 0) logger$5.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				if (Object.keys(resolved).length > 0) logger$4.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
 				const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
 				const buildArgs = [];
 				const publicUrlArgNames = [];
@@ -7388,10 +7527,10 @@ async function workspaceDeployCommand(configured, options) {
 						publicUrlArgNames.push(key);
 					}
 				}
-				if (buildArgs.length > 0) logger$5.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
+				if (buildArgs.length > 0) logger$4.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$5.log(`      Building Docker image: ${imageRef}`);
+				logger$4.log(`      Building Docker image: ${imageRef}`);
 				await deployDocker({
 					stage,
 					tag: imageTag,
@@ -7412,14 +7551,14 @@ async function workspaceDeployCommand(configured, options) {
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
 				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger$5.log(`      Deploying to Dokploy...`);
+				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
 				const existingFrontendDomain = (await api.getDomainsByApplicationId(application.applicationId)).find((d) => d.host === frontendHost);
 				if (existingFrontendDomain) {
 					appHostnames.set(appName, frontendHost);
 					appDomainIds.set(appName, existingFrontendDomain.domainId);
 					publicUrls[appName] = `https://${frontendHost}`;
-					logger$5.log(`      ✓ Domain: https://${frontendHost} (existing)`);
+					logger$4.log(`      ✓ Domain: https://${frontendHost} (existing)`);
 				} else try {
 					const domain = await api.createDomain({
 						host: frontendHost,
@@ -7431,10 +7570,10 @@ async function workspaceDeployCommand(configured, options) {
 					appHostnames.set(appName, frontendHost);
 					appDomainIds.set(appName, domain.domainId);
 					publicUrls[appName] = `https://${frontendHost}`;
-					logger$5.log(`      ✓ Domain: https://${frontendHost} (created)`);
+					logger$4.log(`      ✓ Domain: https://${frontendHost} (created)`);
 				} catch (domainError) {
 					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$5.log(`      ⚠ Domain creation failed: ${message}`);
+					logger$4.log(`      ⚠ Domain creation failed: ${message}`);
 					appHostnames.set(appName, frontendHost);
 					publicUrls[appName] = `https://${frontendHost}`;
 				}
@@ -7445,10 +7584,10 @@ async function workspaceDeployCommand(configured, options) {
 					applicationId: application.applicationId,
 					imageRef
 				});
-				logger$5.log(`      ✓ ${appName} deployed successfully`);
+				logger$4.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : "Unknown error";
-				logger$5.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+				logger$4.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 				results.push({
 					appName,
 					type: app.type,
@@ -7458,9 +7597,9 @@ async function workspaceDeployCommand(configured, options) {
 			}
 		}
 	}
-	logger$5.log("\n📋 Saving deploy state...");
+	logger$4.log("\n📋 Saving deploy state...");
 	await stateProvider.write(stage, state);
-	logger$5.log("   ✓ State saved");
+	logger$4.log("   ✓ State saved");
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, creds.endpoint);
@@ -7469,27 +7608,27 @@ async function workspaceDeployCommand(configured, options) {
 			await stateProvider.write(stage, state);
 		}
 		if (dnsResult?.success && appHostnames.size > 0) {
-			logger$5.log("\n🔒 Validating domains for SSL certificates...");
+			logger$4.log("\n🔒 Validating domains for SSL certificates...");
 			for (const [appName, hostname] of appHostnames) try {
 				const result = await api.validateDomain(hostname);
-				if (result.isValid) logger$5.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
-				else logger$5.log(`   ⚠ ${appName}: ${hostname} not valid`);
+				if (result.isValid) logger$4.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+				else logger$4.log(`   ⚠ ${appName}: ${hostname} not valid`);
 			} catch (validationError) {
 				const message = validationError instanceof Error ? validationError.message : "Unknown error";
-				logger$5.log(`   ⚠ ${appName}: validation failed - ${message}`);
+				logger$4.log(`   ⚠ ${appName}: validation failed - ${message}`);
 			}
 		}
 	}
 	const successCount = results.filter((r) => r.success).length;
 	const failedCount = results.filter((r) => !r.success).length;
-	logger$5.log(`\n${"─".repeat(50)}`);
-	logger$5.log(`\n✅ Workspace deployment complete!`);
-	logger$5.log(`   Project: ${project.projectId}`);
-	logger$5.log(`   Successful: ${successCount}`);
-	if (failedCount > 0) logger$5.log(`   Failed: ${failedCount}`);
+	logger$4.log(`\n${"─".repeat(50)}`);
+	logger$4.log(`\n✅ Workspace deployment complete!`);
+	logger$4.log(`   Project: ${project.projectId}`);
+	logger$4.log(`   Successful: ${successCount}`);
+	if (failedCount > 0) logger$4.log(`   Failed: ${failedCount}`);
 	if (Object.keys(publicUrls).length > 0) {
-		logger$5.log("\n   📡 Deployed URLs:");
-		for (const [name, url] of Object.entries(publicUrls)) logger$5.log(`      ${name}: ${url}`);
+		logger$4.log("\n   📡 Deployed URLs:");
+		for (const [name, url] of Object.entries(publicUrls)) logger$4.log(`      ${name}: ${url}`);
 	}
 	return {
 		apps: results,
@@ -7508,7 +7647,7 @@ async function deployCommand(options) {
 }
 //#endregion
 //#region src/deploy/init.ts
-const logger$4 = console;
+const logger$3 = console;
 /**
 * Get the Dokploy API token from stored credentials or environment
 */
@@ -7554,28 +7693,28 @@ function unsafeToRewrite(content) {
 async function updateConfig(config, cwd = process.cwd()) {
 	const configPath = (0, node_path.join)(cwd, "gkm.config.ts");
 	if (!(0, node_fs.existsSync)(configPath)) {
-		logger$4.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
-		logger$4.log(`  providers: {`);
-		logger$4.log(`    dokploy: {`);
-		logger$4.log(`      endpoint: '${config.endpoint}',`);
-		logger$4.log(`      projectId: '${config.projectId}',`);
-		logger$4.log(`      applicationId: '${config.applicationId}',`);
-		logger$4.log(`    },`);
-		logger$4.log(`  },`);
+		logger$3.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
+		logger$3.log(`  providers: {`);
+		logger$3.log(`    dokploy: {`);
+		logger$3.log(`      endpoint: '${config.endpoint}',`);
+		logger$3.log(`      projectId: '${config.projectId}',`);
+		logger$3.log(`      applicationId: '${config.applicationId}',`);
+		logger$3.log(`    },`);
+		logger$3.log(`  },`);
 		return;
 	}
 	const content = await (0, node_fs_promises.readFile)(configPath, "utf-8");
 	if (unsafeToRewrite(content)) {
-		logger$4.warn("\n  gkm.config.ts holds a dokploy block this cannot safely rewrite —\n  it contains an expression or a nested object. Leaving it alone.");
-		logger$4.log(`\n  Discovered, if you want them written down:`);
-		logger$4.log(`    projectId: '${config.projectId}'`);
-		logger$4.log(`    applicationId: '${config.applicationId}'`);
-		if (config.registryId) logger$4.log(`    registryId: '${config.registryId}'`);
+		logger$3.warn("\n  gkm.config.ts holds a dokploy block this cannot safely rewrite —\n  it contains an expression or a nested object. Leaving it alone.");
+		logger$3.log(`\n  Discovered, if you want them written down:`);
+		logger$3.log(`    projectId: '${config.projectId}'`);
+		logger$3.log(`    applicationId: '${config.applicationId}'`);
+		if (config.registryId) logger$3.log(`    registryId: '${config.registryId}'`);
 		return;
 	}
 	if (content.includes("dokploy:") && content.includes("applicationId:")) {
-		logger$4.log("\n  Dokploy config already exists in gkm.config.ts");
-		logger$4.log("  Updating with new values...");
+		logger$3.log("\n  Dokploy config already exists in gkm.config.ts");
+		logger$3.log("  Updating with new values...");
 	}
 	const registryLine = config.registryId ? `\n\t\t\tregistryId: '${config.registryId}',` : "";
 	const dokployConfigStr = `dokploy: {
@@ -7593,7 +7732,7 @@ async function updateConfig(config, cwd = process.cwd()) {
 	},
 });`);
 	await (0, node_fs_promises.writeFile)(configPath, newContent);
-	logger$4.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
+	logger$3.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
 }
 /**
 * Initialize Dokploy deployment configuration
@@ -7602,22 +7741,22 @@ async function deployInitCommand(options) {
 	const { projectName, appName, projectId: existingProjectId, registryId } = options;
 	const endpoint = await getEndpoint(options.endpoint);
 	const api = await createApi(endpoint);
-	logger$4.log(`\n🚀 Initializing Dokploy deployment...`);
-	logger$4.log(`   Endpoint: ${endpoint}`);
+	logger$3.log(`\n🚀 Initializing Dokploy deployment...`);
+	logger$3.log(`   Endpoint: ${endpoint}`);
 	let projectId;
 	if (existingProjectId) {
 		projectId = existingProjectId;
-		logger$4.log(`\n📁 Using existing project: ${projectId}`);
+		logger$3.log(`\n📁 Using existing project: ${projectId}`);
 	} else {
-		logger$4.log(`\n📁 Looking for project: ${projectName}`);
+		logger$3.log(`\n📁 Looking for project: ${projectName}`);
 		const existingProject = (await api.listProjects()).find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 		if (existingProject) {
 			projectId = existingProject.projectId;
-			logger$4.log(`   Found existing project: ${projectId}`);
+			logger$3.log(`   Found existing project: ${projectId}`);
 		} else {
-			logger$4.log(`   Creating new project...`);
+			logger$3.log(`   Creating new project...`);
 			projectId = (await api.createProject(projectName)).project.projectId;
-			logger$4.log(`   ✓ Created project: ${projectId}`);
+			logger$3.log(`   ✓ Created project: ${projectId}`);
 		}
 	}
 	const project = await api.getProject(projectId);
@@ -7625,22 +7764,22 @@ async function deployInitCommand(options) {
 	const firstEnv = project.environments?.[0];
 	if (firstEnv) environmentId = firstEnv.environmentId;
 	else {
-		logger$4.log(`   Creating production environment...`);
+		logger$3.log(`   Creating production environment...`);
 		environmentId = (await api.createEnvironment(projectId, "production")).environmentId;
 	}
-	logger$4.log(`\n📦 Creating application: ${appName}`);
+	logger$3.log(`\n📦 Creating application: ${appName}`);
 	const application = await api.createApplication(appName, projectId, environmentId);
-	logger$4.log(`   ✓ Created application: ${application.applicationId}`);
+	logger$3.log(`   ✓ Created application: ${application.applicationId}`);
 	if (registryId) {
-		logger$4.log(`\n🔧 Configuring registry: ${registryId}`);
+		logger$3.log(`\n🔧 Configuring registry: ${registryId}`);
 		await api.updateApplication(application.applicationId, { registryId });
-		logger$4.log(`   ✓ Registry configured`);
+		logger$3.log(`   ✓ Registry configured`);
 	} else try {
 		const registries = await api.listRegistries();
 		if (registries.length > 0) {
-			logger$4.log(`\n📋 Available registries:`);
-			for (const reg of registries) logger$4.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
-			logger$4.log(`\n   To use a registry, run with --registry-id <id>`);
+			logger$3.log(`\n📋 Available registries:`);
+			for (const reg of registries) logger$3.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
+			logger$3.log(`\n   To use a registry, run with --registry-id <id>`);
 		}
 	} catch {}
 	const config = {
@@ -7649,14 +7788,14 @@ async function deployInitCommand(options) {
 		applicationId: application.applicationId
 	};
 	await updateConfig(config);
-	logger$4.log(`\n✅ Dokploy deployment initialized!`);
-	logger$4.log(`\n📋 Configuration:`);
-	logger$4.log(`   Project ID: ${projectId}`);
-	logger$4.log(`   Application ID: ${application.applicationId}`);
-	logger$4.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
-	logger$4.log(`\n📝 Next steps:`);
-	logger$4.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
-	logger$4.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
+	logger$3.log(`\n✅ Dokploy deployment initialized!`);
+	logger$3.log(`\n📋 Configuration:`);
+	logger$3.log(`   Project ID: ${projectId}`);
+	logger$3.log(`   Application ID: ${application.applicationId}`);
+	logger$3.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
+	logger$3.log(`\n📝 Next steps:`);
+	logger$3.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
+	logger$3.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
 	return config;
 }
 /**
@@ -7667,31 +7806,31 @@ async function deployListCommand(options) {
 	const api = await createApi(endpoint);
 	const { resource } = options;
 	if (resource === "projects") {
-		logger$4.log(`\n📁 Projects in ${endpoint}:`);
+		logger$3.log(`\n📁 Projects in ${endpoint}:`);
 		const projects = await api.listProjects();
 		if (projects.length === 0) {
-			logger$4.log("   No projects found");
+			logger$3.log("   No projects found");
 			return;
 		}
 		for (const project of projects) {
-			logger$4.log(`\n   ${project.name} (${project.projectId})`);
-			if (project.description) logger$4.log(`     ${project.description}`);
+			logger$3.log(`\n   ${project.name} (${project.projectId})`);
+			if (project.description) logger$3.log(`     ${project.description}`);
 		}
 	} else if (resource === "registries") {
-		logger$4.log(`\n🐳 Registries in ${endpoint}:`);
+		logger$3.log(`\n🐳 Registries in ${endpoint}:`);
 		const registries = await api.listRegistries();
 		if (registries.length === 0) {
-			logger$4.log("   No registries configured");
-			logger$4.log("   Run \"gkm registry:setup\" to configure a registry");
+			logger$3.log("   No registries configured");
+			logger$3.log("   Run \"gkm registry:setup\" to configure a registry");
 			return;
 		}
 		const storedRegistryId = await getDokployRegistryId();
 		for (const registry of registries) {
 			const marker = registry.registryId === storedRegistryId ? " (default)" : "";
-			logger$4.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
-			logger$4.log(`     URL: ${registry.registryUrl}`);
-			logger$4.log(`     Username: ${registry.username}`);
-			if (registry.imagePrefix) logger$4.log(`     Prefix: ${registry.imagePrefix}`);
+			logger$3.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
+			logger$3.log(`     URL: ${registry.registryUrl}`);
+			logger$3.log(`     Username: ${registry.username}`);
+			if (registry.imagePrefix) logger$3.log(`     Prefix: ${registry.imagePrefix}`);
 		}
 	}
 }
@@ -7993,15 +8132,20 @@ function databaseFiles() {
 	return [{
 		path: "src/constructs/database.ts",
 		content: `import { KyselyDatabase } from '@geekmidas/constructs/database/kysely';
-import type { Generated } from 'kysely';
+import { CamelCasePlugin, type Generated } from 'kysely';
 
-/** Your database schema. Add tables here. */
+/**
+ * Your database schema. Add tables here.
+ *
+ * camelCase, because of the plugin below: the columns are snake_case in
+ * Postgres (\`created_at\`), and Kysely maps between the two.
+ */
 export interface Database {
   users: {
     id: Generated<string>;
     name: string;
     email: string;
-    created_at: Generated<Date>;
+    createdAt: Generated<Date>;
   };
 }
 
@@ -8016,7 +8160,11 @@ export interface Database {
  * inference, so passing only \`Database\` would leave the name at \`string\`
  * and widen the service key away from \`${db.service}\`.
  */
-export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}');
+export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}', {
+  // Yours to keep, change or remove. Every connection this construct opens —
+  // every endpoint, the tests — uses it.
+  plugins: [new CamelCasePlugin()],
+});
 `
 	}, usersMigration()];
 }
@@ -8191,7 +8339,7 @@ environment and fail in a way that looks like a config bug. Go through
 \`gkm exec --\`, which is what injects them.`);
 	if (!isWorker) sections.push(endpointSection(options));
 	if (isWorker || isServerless) sections.push(backgroundSection(template));
-	if (database) sections.push(databaseSection());
+	if (database) sections.push(databaseSection(), queriesSection());
 	sections.push(`## Environment
 
 Environment is parsed once, through \`envkit\`, and never read from
@@ -8378,6 +8526,88 @@ export const monthly = router
 Queries go through Kysely. Never open your own connection pool — the one the
 construct provides is the one that gets credentials, pooling and shutdown.`;
 }
+function queriesSection() {
+	return `## Writing queries and relations
+
+**Names: snake_case in Postgres, camelCase in TypeScript.** Kysely's
+\`CamelCasePlugin\` does the mapping, and it is set where you can see it — on
+the database construct in \`constructs/database.ts\`:
+
+\`\`\`typescript
+export const database = new KyselyDatabase<Database, 'Database'>('Database', {
+  plugins: [new CamelCasePlugin()],
+});
+\`\`\`
+
+It is the project's plugin, not the toolbox's: keep it, change it, or remove it,
+but do it there. It applies to every connection the construct opens: every
+endpoint, and the tests, which connect through the construct.
+
+- The \`Database\` interface is camelCase: \`userId\`, \`createdAt\`.
+- Migrations are the SQL, so they spell columns in snake_case.
+- A raw \`sql\` fragment is not rewritten. Refer to columns with
+  \`sql.ref('users.createdAt')\` or \`eb.ref(…)\`, never inside the string.
+- A schema tenant takes its own options. Better Auth's tenant gets no plugin —
+  its tables are its own.
+
+**Types.** \`Generated<T>\` for every column the database fills in (ids,
+defaults, timestamps). Derive row types with \`Selectable<Database['users']>\`,
+\`Insertable<…>\` and \`Updateable<…>\` rather than writing them again.
+
+**Relations are foreign keys.** Every \`*_id\` column references its parent,
+with its delete rule written out:
+
+\`\`\`typescript
+.addColumn('user_id', 'uuid', (col) =>
+  col.notNull().references('users.id').onDelete('cascade'),
+)
+\`\`\`
+
+- \`restrict\` by default.
+- \`cascade\` only for rows that belong to the parent — a user's notifications.
+- \`set null\` for an optional link, on a nullable column.
+- Index every foreign key column. Postgres does not do it for you.
+
+**Reading related rows: one query, nested.** \`jsonArrayFrom\` and
+\`jsonObjectFrom\` from \`kysely/helpers/postgres\` return children already in
+the shape of the response:
+
+\`\`\`typescript
+import { jsonArrayFrom } from 'kysely/helpers/postgres';
+
+const user = await db
+  .selectFrom('users')
+  .select((eb) => [
+    'users.id',
+    'users.name',
+    jsonArrayFrom(
+      eb
+        .selectFrom('notifications')
+        .select(['notifications.id', 'notifications.body', 'notifications.createdAt'])
+        .whereRef('notifications.userId', '=', 'users.id')
+        .orderBy('notifications.createdAt', 'desc'),
+    ).as('notifications'),
+  ])
+  .where('users.id', '=', id)
+  .executeTakeFirstOrThrow();
+\`\`\`
+
+- Never query once per row in a loop.
+- Use joins to filter, or for a flat result — not to build nested ones by hand.
+- Qualify columns (\`users.id\`) once a query touches more than one table.
+- Select the columns the response needs. \`selectAll()\` only returns a whole
+  row.
+- Nested rows come back as JSON: a timestamp inside \`jsonArrayFrom\` is a
+  string, not a \`Date\`. Say so in the output schema (\`z.coerce.date()\`).
+
+**Writes that touch several tables run in one transaction.** Use
+\`withTransaction(db, async (trx) => …)\` from \`@geekmidas/db/kysely\`: it joins
+the transaction \`db\` already is — an endpoint with an auditor, a test —
+instead of opening a second one.
+
+**Lists paginate by cursor**, with \`paginatedSearch\` from
+\`@geekmidas/db/kysely/pagination\`, not by offset.`;
+}
 function conventionsSection() {
 	return `## Conventions
 
@@ -8552,26 +8782,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.27",
-	"@geekmidas/auth": "~10.0.0-alpha.27",
-	"@geekmidas/cache": "~10.0.0-alpha.27",
-	"@geekmidas/client": "~10.0.0-alpha.27",
-	"@geekmidas/cloud": "~10.0.0-alpha.27",
-	"@geekmidas/constructs": "~10.0.0-alpha.27",
-	"@geekmidas/db": "~10.0.0-alpha.27",
-	"@geekmidas/emailkit": "~10.0.0-alpha.27",
-	"@geekmidas/envkit": "~10.0.0-alpha.27",
-	"@geekmidas/errors": "~10.0.0-alpha.27",
-	"@geekmidas/events": "~10.0.0-alpha.27",
-	"@geekmidas/logger": "~10.0.0-alpha.27",
-	"@geekmidas/manifest": "~10.0.0-alpha.27",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.27",
-	"@geekmidas/schema": "~10.0.0-alpha.27",
-	"@geekmidas/services": "~10.0.0-alpha.27",
-	"@geekmidas/storage": "~10.0.0-alpha.27",
-	"@geekmidas/studio": "~10.0.0-alpha.27",
-	"@geekmidas/telescope": "~10.0.0-alpha.27",
-	"@geekmidas/testkit": "~10.0.0-alpha.27",
+	"@geekmidas/audit": "~10.0.0-alpha.29",
+	"@geekmidas/auth": "~10.0.0-alpha.29",
+	"@geekmidas/cache": "~10.0.0-alpha.29",
+	"@geekmidas/client": "~10.0.0-alpha.29",
+	"@geekmidas/cloud": "~10.0.0-alpha.29",
+	"@geekmidas/constructs": "~10.0.0-alpha.29",
+	"@geekmidas/db": "~10.0.0-alpha.29",
+	"@geekmidas/emailkit": "~10.0.0-alpha.29",
+	"@geekmidas/envkit": "~10.0.0-alpha.29",
+	"@geekmidas/errors": "~10.0.0-alpha.29",
+	"@geekmidas/events": "~10.0.0-alpha.29",
+	"@geekmidas/logger": "~10.0.0-alpha.29",
+	"@geekmidas/manifest": "~10.0.0-alpha.29",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.29",
+	"@geekmidas/schema": "~10.0.0-alpha.29",
+	"@geekmidas/services": "~10.0.0-alpha.29",
+	"@geekmidas/storage": "~10.0.0-alpha.29",
+	"@geekmidas/studio": "~10.0.0-alpha.29",
+	"@geekmidas/telescope": "~10.0.0-alpha.29",
+	"@geekmidas/testkit": "~10.0.0-alpha.29",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10509,15 +10739,20 @@ export const logger = createLogger();
 	files.push({
 		path: "constructs/database.ts",
 		content: `import { KyselyDatabase } from '@geekmidas/constructs/database/kysely';
-import type { Generated } from 'kysely';
+import { CamelCasePlugin, type Generated } from 'kysely';
 
-/** Your database schema. Add tables here. */
+/**
+ * Your database schema. Add tables here.
+ *
+ * camelCase, because of the plugin below: the columns are snake_case in
+ * Postgres (\`created_at\`), and Kysely maps between the two.
+ */
 export interface Database {
   users: {
     id: Generated<string>;
     name: string;
     email: string;
-    created_at: Generated<Date>;
+    createdAt: Generated<Date>;
   };
 }
 
@@ -10528,14 +10763,19 @@ export interface Database {
  * \`${db.urlKey}\` all derive from this line — which is why nothing lists
  * \`postgres\` anywhere.
  */
-export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}');
+export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}', {
+  // Yours to keep, change or remove. Every connection this construct opens —
+  // every endpoint, the tests — uses it.
+  plugins: [new CamelCasePlugin()],
+});
 
 /**
  * The auth server's own schema in that same Postgres, with its own role.
  *
  * A schema tenant rather than a second database: one container, and a role
  * whose \`search_path\` is pinned, so Better Auth's tables cannot collide with
- * the application's.
+ * the application's. It takes its own options: no plugin, because Better
+ * Auth names its own columns.
  */
 export const authDb = database.schema<Record<string, never>, 'AuthDb'>('AuthDb');
 `
@@ -10863,54 +11103,11 @@ export const getUserEndpoint = router
 			}
 		];
 		if (options.monorepo) {
-			files.push({
-				path: "src/services/auth.ts",
-				content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
-
-export interface Session {
-  user: {
-    id: string;
-    email: string;
-    name: string;
-  };
-}
-
-export interface AuthClient {
-  getSession: (cookie: string) => Promise<Session | null>;
-}
-
-export const authService = {
-  serviceName: 'auth' as const,
-  async register({ envParser, context }: ServiceRegisterOptions) {
-    const logger = context.getLogger();
-
-    const config = envParser
-      .create((get) => ({
-        url: get('AUTH_URL').string(),
-      }))
-      .parse();
-
-    logger.info({ authUrl: config.url }, 'Auth service configured');
-
-    return {
-      getSession: async (cookie: string): Promise<Session | null> => {
-        const res = await fetch(\`\${config.url}/api/auth/get-session\`, {
-          headers: { cookie },
-        });
-        if (!res.ok) return null;
-        return (await res.json()) as Session | null;
-      },
-    };
-  },
-} satisfies Service<'auth', AuthClient>;
-`
-			});
 			files.push({
 				path: "src/router.ts",
 				content: `import { UnauthorizedError } from '@geekmidas/errors';
 import { api } from '${constructsImport("api")}';${options.constructs.database ? `
 import { database } from '${constructsImport("database")}';` : ""}
-import { authService, type Session } from './services/auth.ts';
 
 /**
  * The shared endpoint factory — no session required.
@@ -10921,15 +11118,17 @@ import { authService, type Session } from './services/auth.ts';
  */
 export const router = api${options.constructs.database ? ".database(database)" : ""};
 
-// The auth client available, but the session not enforced.
-export const r = router.services([authService]);
-
-// Requires an active session — throws when there is none.
-export const sessionRouter = r.session<Session>(async ({ services, header }) => {
-  const cookie = header('cookie') || '';
-  const session = await services.auth.getSession(cookie);
+/**
+ * Requires an active session — throws when there is none.
+ *
+ * \`auth\` is the construct named in \`.auth()\` on the API, bound to this
+ * request: it asks the auth server whose cookie this is. Handlers built from
+ * this router get whatever this returns as \`session\`.
+ */
+export const sessionRouter = router.session(async ({ auth }) => {
+  const session = await auth.getSession();
 
-  if (!session?.user) {
+  if (!session) {
     throw new UnauthorizedError('No active session');
   }
 
@@ -11016,46 +11215,6 @@ export const email = new Email('${mail.id}', { templates: {} });
  * schema and reached by its role, whatever the target.
  */
 export const cache = new Cache('${kv.id}');
-`
-		});
-		if (options.constructs.database && !declares) files.push({
-			path: "src/services/database.ts",
-			content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
-import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
-
-// Define your database schema
-export interface Database {
-  users: {
-    id: string;
-    name: string;
-    email: string;
-    created_at: Date;
-  };
-}
-
-export const databaseService = {
-  serviceName: 'database' as const,
-  async register({ envParser, context }: ServiceRegisterOptions) {
-    const logger = context.getLogger();
-    logger.info('Connecting to database');
-
-    const config = envParser
-      .create((get) => ({
-        url: get('DATABASE_URL').string(),
-      }))
-      .parse();
-
-    const db = new Kysely<Database>({
-      dialect: new PostgresDialect({
-        pool: new pg.Pool({ connectionString: config.url }),
-      }),
-    });
-
-    logger.info('Database connection established');
-    return db;
-  },
-} satisfies Service<'database', Kysely<Database>>;
 `
 		});
 		if (options.telescope) files.push({
@@ -11074,17 +11233,19 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from '${src(declares ? "constructs/database.ts" : "services/database.ts")}';
+import { type Database, database } from '${declares ? src("constructs/database.ts") : constructsImport("database")}';
 import { envParser } from '${src("config/env.ts")}';
 
 const studioConfig = envParser
   .create((get) => ({
-    databaseUrl: get('${declares ? db.urlKey : "DATABASE_URL"}').string(),
+    databaseUrl: get('${db.urlKey}').string(),
   }))
   .parse();
 
-// Create a Kysely instance for Studio
+// Studio's own client, built the way the construct builds its own — the same
+// plugins — so the browser shows what the app's queries see.
 const db = new Kysely<Database>({
+  ...database.clientConfig,
   dialect: new PostgresDialect({
     pool: new pg.Pool({ connectionString: studioConfig.databaseUrl }),
   }),
@@ -11439,7 +11600,8 @@ const workerTemplate = {
 		"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 		"@geekmidas/events": GEEKMIDAS_VERSIONS["@geekmidas/events"],
 		"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
-		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"]
+		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
+		zod: DEPENDENCY_VERSIONS.zod
 	},
 	devDependencies: {
 		"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
@@ -11498,51 +11660,34 @@ export const config = envParser
 				content: loggerContent
 			},
 			{
-				path: "src/events/types.ts",
-				content: `import type { PublishableMessage } from '@geekmidas/events';
-
-// Define your event types here
-export type AppEvents =
-  | PublishableMessage<'user.created', { userId: string; email: string }>
-  | PublishableMessage<'user.updated', { userId: string; changes: Record<string, unknown> }>
-  | PublishableMessage<'order.placed', { orderId: string; userId: string; total: number }>;
-`
-			},
-			{
-				path: "src/events/publisher.ts",
-				content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
-import { Publisher, type EventPublisher } from '@geekmidas/events';
-import type { AppEvents } from './types.ts';
-
-export const eventsPublisherService = {
-  serviceName: 'events' as const,
-  async register({ envParser, context }: ServiceRegisterOptions) {
-    const logger = context.getLogger();
-    logger.info('Connecting to message broker');
-
-    const config = envParser
-      .create((get) => ({
-        url: get('RABBITMQ_URL').string().default('amqp://localhost:5672'),
-      }))
-      .parse();
-
-    const publisher = await Publisher.fromConnectionString<AppEvents>(
-      \`rabbitmq://\${config.url.replace('amqp://', '')}?exchange=events\`
-    );
+				path: "src/constructs/topics.ts",
+				content: `import { t } from '@geekmidas/constructs/topic';
+import { z } from 'zod';
 
-    logger.info('Message broker connection established');
-    return publisher;
-  },
-} satisfies Service<'events', EventPublisher<AppEvents>>;
+/**
+ * The \`users\` topic: pub/sub fan-out, any number of subscribers.
+ *
+ * The event map is the contract. It types \`users.publisher\` and every
+ * subscriber that binds with \`.topic(users)\`, so an event cannot be published
+ * in one shape and read in another.
+ */
+export const users = t.topic('users').events({
+  'user.created': z.object({ userId: z.string(), email: z.email() }),
+  'user.updated': z.object({
+    userId: z.string(),
+    changes: z.record(z.string(), z.unknown()),
+  }),
+});
 `
 			},
 			{
 				path: "src/subscribers/user-events.ts",
-				content: `import { worker } from '~/constructs/worker.ts';
-import { eventsPublisherService } from '~/events/publisher.ts';
+				content: `import { users } from '~/constructs/topics.ts';
+import { worker } from '~/constructs/worker.ts';
 
+// Bound to the topic, not handed its publisher: a subscriber consumes.
 export const userEventsSubscriber = worker
-  .publisher(eventsPublisherService)
+  .topic(users)
   .subscribe(['user.created', 'user.updated'])
   .handle(async ({ events, logger }) => {
     // A batch, not a single event. Both transports deliver in batches, so
@@ -11848,7 +11993,7 @@ function generateSourceFiles(options, template) {
 function generateTestFiles(options, _template) {
 	if (!options.constructs.database) return [];
 	const db = databaseFor();
-	const schema = !options.monorepo ? "../src/constructs/database.ts" : "~/services/database.ts";
+	const schema = !options.monorepo ? "../src/constructs/database.ts" : `@${options.name}/constructs/database.ts`;
 	const runtimeUrl = db.urlKey;
 	const ownerUrl = db.ownerUrlKey;
 	return [
@@ -11877,21 +12022,13 @@ export default defineConfig({
 		{
 			path: "test/config.ts",
 			content: `import { it as itVitest } from 'vitest';
-import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
 import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
-import type { Database } from '${schema}';
-
-const db = new Kysely<Database>({
-  dialect: new PostgresDialect({
-    pool: new pg.Pool({ connectionString: process.env.${runtimeUrl} }),
-  }),
-});
+import { type Database, database } from '${schema}';
 
 export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
-  // A function, or a construct: an instance is taken for a construct and has
-  // no service to register.
-  connection: () => db,
+  // The construct itself, so the tests connect the way the app does — with
+  // the plugins it was given, \`CamelCasePlugin\` included.
+  connection: database,
 });
 `
 		},
@@ -11965,7 +12102,7 @@ export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
     id: faker.string.uuid(),
     name: faker.person.fullName(),
     email: faker.internet.email(),
-    created_at: new Date(),
+    createdAt: new Date(),
   }),
 );
 `
@@ -14650,7 +14787,7 @@ var NotAnAwsRegion = class extends Error {
 };
 //#endregion
 //#region src/secrets/index.ts
-const logger$3 = console;
+const logger$2 = console;
 /**
 * Initialize secrets for a stage.
 * Generates secure random passwords for configured services.
@@ -14658,7 +14795,7 @@ const logger$3 = console;
 async function secretsInitCommand(options) {
 	const { stage, force } = options;
 	if (!force && require_storage.secretsExist(stage)) {
-		logger$3.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
+		logger$2.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
 		process.exit(1);
 	}
 	let projectName;
@@ -14668,21 +14805,20 @@ async function secretsInitCommand(options) {
 		projectName = loaded.workspace.name;
 		if (Object.keys(loaded.workspace.apps).length > 1) {
 			workspaceSecrets = require_reconcile.generateFullstackCustomSecrets(loaded.workspace);
-			logger$3.log("  Detected workspace mode — generating per-app secrets");
+			logger$2.log("  Detected workspace mode — generating per-app secrets");
 		}
 	} catch {}
 	const secrets = require_reconcile.createStageSecrets(stage, [], { projectName });
 	if (workspaceSecrets) secrets.custom = workspaceSecrets;
 	await require_storage.writeStageSecrets(secrets);
-	logger$3.log(`\n✓ Secrets initialized for stage "${stage}"`);
-	logger$3.log(`  Location: .gkm/secrets/${stage}.json`);
-	if (secrets.urls.DATABASE_URL) logger$3.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
-	if (secrets.urls.REDIS_URL) logger$3.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger$3.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
-	if (secrets.urls.STORAGE_ENDPOINT) logger$3.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
-	if (Object.keys(secrets.custom).length > 0) logger$3.log(`\n  Custom secrets: ${Object.keys(secrets.custom).length}`);
-	logger$3.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
-	logger$3.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
+	logger$2.log(`\n✓ Secrets initialized for stage "${stage}"`);
+	logger$2.log(`  Location: .gkm/secrets/${stage}.json`);
+	if (secrets.urls.DATABASE_URL) logger$2.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
+	if (Object.keys(secrets.custom).length > 0) logger$2.log(`\n  Custom secrets: ${Object.keys(secrets.custom).length}`);
+	logger$2.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
+	logger$2.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
 }
 /**
 * Read all data from stdin.
@@ -14701,21 +14837,21 @@ async function secretsSetCommand(key, value, options) {
 	let secretValue = value;
 	if (!secretValue) {
 		if (process.stdin.isTTY) {
-			logger$3.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
-			logger$3.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
+			logger$2.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
+			logger$2.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
 			process.exit(1);
 		}
 		secretValue = await readStdin();
 		if (!secretValue) {
-			logger$3.error("No value received from stdin");
+			logger$2.error("No value received from stdin");
 			process.exit(1);
 		}
 	}
 	try {
 		await require_storage.setCustomSecret(stage, key, secretValue);
-		logger$3.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
+		logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
 	} catch (error) {
-		logger$3.error(error instanceof Error ? error.message : "Failed to set secret");
+		logger$2.error(error instanceof Error ? error.message : "Failed to set secret");
 		process.exit(1);
 	}
 }
@@ -14726,33 +14862,31 @@ async function secretsShowCommand(options) {
 	const { stage, reveal } = options;
 	const secrets = await require_storage.readStageSecrets(stage);
 	if (!secrets) {
-		logger$3.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
-	logger$3.log(`\nSecrets for stage "${stage}":`);
-	logger$3.log(`  Created: ${secrets.createdAt}`);
-	logger$3.log(`  Updated: ${secrets.updatedAt}`);
-	logger$3.log("\nService Credentials:");
+	logger$2.log(`\nSecrets for stage "${stage}":`);
+	logger$2.log(`  Created: ${secrets.createdAt}`);
+	logger$2.log(`  Updated: ${secrets.updatedAt}`);
+	logger$2.log("\nService Credentials:");
 	for (const [service, creds] of Object.entries(secrets.services)) if (creds) {
-		logger$3.log(`\n  ${service}:`);
-		logger$3.log(`    host: ${creds.host}`);
-		logger$3.log(`    port: ${creds.port}`);
-		logger$3.log(`    username: ${creds.username}`);
-		logger$3.log(`    password: ${reveal ? creds.password : require_storage.maskPassword(creds.password)}`);
-		if (creds.database) logger$3.log(`    database: ${creds.database}`);
-		if (creds.vhost) logger$3.log(`    vhost: ${creds.vhost}`);
-		if (creds.bucket) logger$3.log(`    bucket: ${creds.bucket}`);
-	}
-	logger$3.log("\nConnection URLs:");
-	if (secrets.urls.DATABASE_URL) logger$3.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
-	if (secrets.urls.REDIS_URL) logger$3.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger$3.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
-	if (secrets.urls.STORAGE_ENDPOINT) logger$3.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
+		logger$2.log(`\n  ${service}:`);
+		logger$2.log(`    host: ${creds.host}`);
+		logger$2.log(`    port: ${creds.port}`);
+		logger$2.log(`    username: ${creds.username}`);
+		logger$2.log(`    password: ${reveal ? creds.password : require_storage.maskPassword(creds.password)}`);
+		if (creds.database) logger$2.log(`    database: ${creds.database}`);
+		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
+	}
+	logger$2.log("\nConnection URLs:");
+	if (secrets.urls.DATABASE_URL) logger$2.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) {
-		logger$3.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger$3.log(`  ${key}: ${reveal ? value : require_storage.maskPassword(value)}`);
+		logger$2.log("\nCustom Secrets:");
+		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_storage.maskPassword(value)}`);
 	}
-	if (!reveal) logger$3.log("\nUse --reveal to show actual values");
+	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
 }
 /**
 * Rotate passwords for services.
@@ -14761,25 +14895,25 @@ async function secretsRotateCommand(options) {
 	const { stage, service } = options;
 	const secrets = await require_storage.readStageSecrets(stage);
 	if (!secrets) {
-		logger$3.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
 	if (service) {
 		if (!secrets.services[service]) {
-			logger$3.error(`Service "${service}" not configured in stage "${stage}"`);
+			logger$2.error(`Service "${service}" not configured in stage "${stage}"`);
 			process.exit(1);
 		}
 		const updated = require_reconcile.rotateServicePassword(secrets, service);
 		await require_storage.writeStageSecrets(updated);
-		logger$3.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
+		logger$2.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
 	} else {
 		let updated = secrets;
 		const services = Object.keys(secrets.services);
 		for (const svc of services) updated = require_reconcile.rotateServicePassword(updated, svc);
 		await require_storage.writeStageSecrets(updated);
-		logger$3.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
+		logger$2.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
 	}
-	logger$3.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
+	logger$2.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
 }
 /**
 * Import secrets from a JSON file.
@@ -14787,7 +14921,7 @@ async function secretsRotateCommand(options) {
 async function secretsImportCommand(file, options) {
 	const { stage, merge = true } = options;
 	if (!(0, node_fs.existsSync)(file)) {
-		logger$3.error(`File not found: ${file}`);
+		logger$2.error(`File not found: ${file}`);
 		process.exit(1);
 	}
 	let importedSecrets;
@@ -14797,12 +14931,12 @@ async function secretsImportCommand(file, options) {
 		if (typeof importedSecrets !== "object" || importedSecrets === null) throw new Error("JSON must be an object");
 		for (const [key, value] of Object.entries(importedSecrets)) if (typeof value !== "string") throw new Error(`Value for "${key}" must be a string, got ${typeof value}`);
 	} catch (error) {
-		logger$3.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
+		logger$2.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
 		process.exit(1);
 	}
 	const secrets = await require_storage.readStageSecrets(stage);
 	if (!secrets) {
-		logger$3.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
 	const updatedCustom = merge ? {
@@ -14817,10 +14951,10 @@ async function secretsImportCommand(file, options) {
 	await require_storage.writeStageSecrets(updated);
 	const importedCount = Object.keys(importedSecrets).length;
 	const totalCount = Object.keys(updatedCustom).length;
-	logger$3.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
-	if (merge && totalCount > importedCount) logger$3.log(`  Total custom secrets: ${totalCount}`);
-	logger$3.log("\n  Imported keys:");
-	for (const key of Object.keys(importedSecrets)) logger$3.log(`    - ${key}`);
+	logger$2.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
+	if (merge && totalCount > importedCount) logger$2.log(`  Total custom secrets: ${totalCount}`);
+	logger$2.log("\n  Imported keys:");
+	for (const key of Object.keys(importedSecrets)) logger$2.log(`    - ${key}`);
 }
 /**
 * Mask password in a URL for display.
@@ -14835,175 +14969,120 @@ function maskUrl(url) {
 	}
 }
 //#endregion
-//#region src/trust/index.ts
-/**
-* Installing the local edge's certificate authority into the OS trust store.
-*
-* `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test
-* suite, anything under `gkm exec` — because reconcile injects it. A browser
-* reads none of that: it asks the operating system, so until the root is in the
-* system store a local `https://` address is "not secure", which is true and
-* unhelpful.
-*
-* A separate command rather than part of `gkm setup`, for one reason: this
-* needs `sudo`, and a setup that silently escalates on every run is a worse
-* trade than one that tells you what to type. Caddy's own `caddy trust` draws
-* the line in the same place.
-*/
-const logger$2 = console;
-const run = (0, node_util.promisify)(node_child_process.execFile);
-/**
-* How each platform is told about a new authority.
-*
-* Separate rather than shelled through one script because the failure modes
-* differ and the message should name the real one: macOS refuses without an
-* admin password, Debian needs the file in a specific directory before its
-* updater will look at it.
-*/
-function installation(platform, certificate) {
-	if (platform === "darwin") return {
-		describe: "the System keychain",
-		steps: [["sudo", [
-			"security",
-			"add-trusted-cert",
-			"-d",
-			"-r",
-			"trustRoot",
-			"-k",
-			"/Library/Keychains/System.keychain",
-			certificate
-		]]]
-	};
-	if (platform === "linux") {
-		const debian = (0, node_fs.existsSync)("/usr/local/share/ca-certificates");
-		return {
-			describe: debian ? "the system CA bundle" : "the system trust anchors",
-			steps: debian ? [["sudo", [
-				"cp",
-				certificate,
-				"/usr/local/share/ca-certificates/gkm-local-ca.crt"
-			]], ["sudo", ["update-ca-certificates"]]] : [["sudo", [
-				"cp",
-				certificate,
-				"/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt"
-			]], ["sudo", ["update-ca-trust"]]]
-		};
+//#region src/secrets/store.ts
+/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */
+var FileSecretsStore = class {
+	root;
+	constructor(root) {
+		this.root = root;
 	}
-	throw new UnsupportedPlatform(platform, certificate);
-}
-/**
-* Trust the certificate authority this project's edge issues from.
-*
-* Idempotent in effect: installing a root that is already trusted replaces the
-* same entry, so running it twice is not an error.
-*/
-async function trustCommand(options = {}) {
-	const { workspace } = await require_config.loadWorkspaceConfig();
-	const certificate = (0, node_path.join)(workspace.root, require_workspace$1.LOCAL_CA_PATH);
-	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
-	const { describe, steps } = installation(process.platform, certificate);
-	logger$2.log(`\n🔐 Trusting the local authority in ${describe}`);
-	logger$2.log(`   ${certificate}\n`);
-	if (options.dryRun) {
-		for (const [command, args] of steps) logger$2.log(`   ${command} ${args.join(" ")}`);
-		return;
+	pull(stage) {
+		return require_storage.readStageSecrets(stage, this.root);
 	}
-	logger$2.log("   This needs an admin password.\n");
-	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
-	logger$2.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
-}
+	push(_stage, secrets) {
+		return require_storage.writeStageSecrets(secrets, this.root);
+	}
+};
 /**
-* Trust the authority if this machine lacks it and its owner agrees.
-*
-* A machine's answer, not the project's: whether a laptop installs a root
-* certificate is its owner's call, so the decision is `--yes`, then what this
-* machine previously answered, then a prompt. Never a silent `sudo` — that is
-* the one thing a setup command should not do on somebody's behalf.
+* The store a stage's secrets live in.
 *
-* Silent and free when the machine already trusts it, which is what makes it
-* acceptable to call on every `gkm setup`.
-*/
-async function ensureTrusted(root, url, options = {}) {
-	if (await isTrusted(url)) return;
-	if (!options.assumeYes) {
-		if (!process.stdin.isTTY) {
-			logger$2.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
-			return;
-		}
-		if (await declined(root)) return;
-		const { install } = await (0, prompts.default)({
-			type: "confirm",
-			name: "install",
-			message: "Trust this project's local certificate authority, so a browser accepts its https addresses? (needs sudo)",
-			initial: false
-		});
-		if (!install) {
-			await recordDeclined(root);
-			logger$2.log("   Skipped. Run \"gkm trust\" later.");
-			return;
-		}
-	}
-	await trustCommand();
-}
-/** Where a declined answer is remembered, so setup asks once and not again. */
-const TRUST_STATE = ".gkm/trust.json";
-async function declined(root) {
-	try {
-		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(root, TRUST_STATE), "utf-8");
-		return JSON.parse(raw).declined === true;
-	} catch {
-		return false;
-	}
+* The local stage is always the file: its secrets belong to the machine
+* running `gkm dev`. A deployed stage uses `secrets.store`.
+*/
+async function secretsStoreFor(workspace, stage, options = {}) {
+	const configured = workspace.secrets.store ?? "file";
+	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root);
+	if (configured.provider !== "ssm") return configured.provider;
+	const { SsmSecretsStore } = await Promise.resolve().then(() => require("./ssm-FxeSAt35.cjs"));
+	return new SsmSecretsStore({
+		project: workspace.name,
+		region: configured.region,
+		...options.profile ? { profile: options.profile } : {}
+	});
 }
-async function recordDeclined(root) {
-	const path = (0, node_path.join)(root, TRUST_STATE);
-	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
-	await (0, node_fs_promises.writeFile)(path, `${JSON.stringify({ declined: true }, null, 2)}\n`);
+/** Whether a stage's secrets live somewhere other than this machine. */
+function isRemoteStore(workspace, stage) {
+	const configured = workspace.secrets.store ?? "file";
+	return stage !== workspace.stages.local && configured !== "file";
 }
+//#endregion
+//#region src/secrets/transfer.ts
 /**
-* Whether this machine already trusts the local authority.
-*
-* Asked by connecting rather than by reading a keychain: what matters is
-* whether a client with no special configuration verifies the edge, and that is
-* one platform-neutral question instead of three platform-specific ones. It is
-* also the exact thing a browser is about to do.
+* Moving a deployed stage's secrets between this machine and its store.
 *
-* A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and
-* this process almost certainly has it set — asking in-process would answer
-* "yes" for everyone.
-*/
-async function isTrusted(url) {
-	const { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;
-	try {
-		await run(process.execPath, ["-e", `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`], {
-			env,
-			timeout: 15e3
-		});
-		return true;
-	} catch {
-		return false;
+* `push` sends the encrypted local copy to the stage's store; `pull` brings it
+* back and writes the local copy a deploy reads — generating a key for it if
+* the machine has none, which is what a fresh CI runner needs. Both reconcile
+* the keys the workspace now derives, so a store never lags a new construct.
+*/
+var transfer_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	NoLocalSecrets: () => NoLocalSecrets,
+	NoRemoteSecretsStore: () => NoRemoteSecretsStore,
+	NoStoredSecrets: () => NoStoredSecrets,
+	pullStageSecrets: () => pullStageSecrets,
+	pushStageSecrets: () => pushStageSecrets
+});
+/** A push or pull for a stage with nowhere to push or pull from. */
+var NoRemoteSecretsStore = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Stage "${stage}" keeps its secrets in the local file, so there is nothing to push or pull. Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.`);
+		this.stage = stage;
+		this.name = "NoRemoteSecretsStore";
 	}
-}
-/** The edge has not run, so there is no authority to trust yet. */
-var NoLocalAuthority = class extends Error {
-	path;
-	constructor(path) {
-		super(`No local certificate authority at ${path}. It is generated the first time the edge starts, so run "gkm setup" (or "gkm dev") once — and if this project declares no file server, nothing needs one.`);
-		this.path = path;
-		this.name = "NoLocalAuthority";
+};
+/** A push for a stage whose secrets this machine does not have. */
+var NoLocalSecrets = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No secrets for stage "${stage}" on this machine. Run gkm secrets:init --stage ${stage} first.`);
+		this.stage = stage;
+		this.name = "NoLocalSecrets";
 	}
 };
-/** A platform with no trust store this knows how to write to. */
-var UnsupportedPlatform = class extends Error {
-	platform;
-	certificate;
-	constructor(platform, certificate) {
-		super(`gkm does not know how to install a certificate authority on ${platform}. The root is at ${certificate} — add it to the trust store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`);
-		this.platform = platform;
-		this.certificate = certificate;
-		this.name = "UnsupportedPlatform";
+/** A pull for a stage the store holds nothing for. */
+var NoStoredSecrets = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The store holds no secrets for stage "${stage}". Push them first: gkm secrets:push --stage ${stage}.`);
+		this.stage = stage;
+		this.name = "NoStoredSecrets";
 	}
 };
+async function reconcile(secrets, workspace, stage) {
+	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-B3ApLW6p.cjs")).then((n) => n.workspace_exports);
+	const result = require_reconcile.reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
+	return result ? {
+		secrets: result.secrets,
+		addedKeys: result.addedKeys
+	} : {
+		secrets,
+		addedKeys: []
+	};
+}
+function remoteOnly(workspace, stage) {
+	require_workspace.assertDeployedStage(workspace.stages, stage);
+	if (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);
+}
+/** Send this machine's secrets for a deployed stage to its store. */
+async function pushStageSecrets(workspace, stage, options = {}) {
+	remoteOnly(workspace, stage);
+	const local = await require_storage.readStageSecrets(stage, workspace.root);
+	if (!local) throw new NoLocalSecrets(stage);
+	const result = await reconcile(local, workspace, stage);
+	if (result.addedKeys.length) await require_storage.writeStageSecrets(result.secrets, workspace.root);
+	await (await secretsStoreFor(workspace, stage, options)).push(stage, result.secrets);
+	return result;
+}
+/** Bring a deployed stage's secrets from its store into the local copy. */
+async function pullStageSecrets(workspace, stage, options = {}) {
+	remoteOnly(workspace, stage);
+	const stored = await (await secretsStoreFor(workspace, stage, options)).pull(stage);
+	if (!stored) throw new NoStoredSecrets(stage);
+	const result = await reconcile(stored, workspace, stage);
+	await require_storage.writeStageSecrets(result.secrets, workspace.root);
+	return result;
+}
 //#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
@@ -15072,8 +15151,7 @@ async function reconcileLocal(workspace, stage, options) {
 	}
 	logger$1.log(`🐳 Services: ${result.plan.containers.join(", ")}`);
 	for (const [container, address] of Object.entries(result.addresses)) logger$1.log(`   ${container}: ${address}`);
-	const served = result.plan.resources.find((r) => r.kind === "file-server");
-	const url = served ? result.env[served.envKey] : void 0;
+	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
 /**
@@ -15098,14 +15176,14 @@ async function resolveSecrets(stage, workspace, options) {
 			return reconciled ?? secrets;
 		}
 	}
-	if (require_transfer.isRemoteStore(workspace, stage)) {
+	if (isRemoteStore(workspace, stage)) {
 		logger$1.log("☁️  Checking the secrets store...");
 		try {
-			const { secrets } = await require_transfer.pullStageSecrets(workspace, stage);
+			const { secrets } = await pullStageSecrets(workspace, stage);
 			logger$1.log("✅ Pulled secrets from the store");
 			return secrets;
 		} catch (error) {
-			if (error instanceof require_transfer.NoStoredSecrets) logger$1.log("   The store holds none yet");
+			if (error instanceof NoStoredSecrets) logger$1.log("   The store holds none yet");
 			else logger$1.warn(`⚠️  Could not pull from the store: ${error.message}`);
 		}
 	}
@@ -15132,8 +15210,7 @@ function credentialedServices(containers) {
 		redis: "redis",
 		minio: "minio",
 		mailpit: "mailpit",
-		localstack: "localstack",
-		rabbitmq: "rabbitmq"
+		localstack: "localstack"
 	};
 	return [...new Set(containers.map((container) => byContainer[container]).filter((name) => Boolean(name)))];
 }
@@ -15153,7 +15230,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 				[name]: creds
 			}
 		};
-		result.urls = require_reconcile.generateConnectionUrls(result.services, result.eventsBackend);
+		result.urls = require_reconcile.generateConnectionUrls(result.services);
 		logger$1.log(`   🔄 Adding missing service credentials: ${name}`);
 		changed = true;
 	}
@@ -15171,7 +15248,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 				}
 			}
 		};
-		result.urls = require_reconcile.generateConnectionUrls(result.services, result.eventsBackend);
+		result.urls = require_reconcile.generateConnectionUrls(result.services);
 		logger$1.log("   🔄 Adding missing service credentials: pgboss");
 		changed = true;
 	}
@@ -15239,7 +15316,7 @@ async function generateFreshSecrets(stage, workspace, options) {
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_workspace$1.derivedContainers(workspace, stage));
 	await require_storage.writeStageSecrets(secrets, workspace.root);
 	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (require_transfer.isRemoteStore(workspace, stage) && !options.yes) {
+	if (isRemoteStore(workspace, stage) && !options.yes) {
 		const { shouldPush } = await (0, prompts.default)({
 			type: "confirm",
 			name: "shouldPush",
@@ -15247,7 +15324,7 @@ async function generateFreshSecrets(stage, workspace, options) {
 			initial: true
 		});
 		if (shouldPush) try {
-			await require_transfer.pushStageSecrets(workspace, stage);
+			await pushStageSecrets(workspace, stage);
 			logger$1.log("☁️  Secrets pushed to the store");
 		} catch (error) {
 			logger$1.warn(`⚠️  Could not push to the store: ${error.message}`);
@@ -16095,7 +16172,7 @@ program.command("secrets:show").description("Show secrets for a stage").required
 		process.exit(1);
 	}
 });
-program.command("secrets:rotate").description("Rotate service passwords").requiredOption("--stage <stage>", "Stage name").option("--service <service>", "Specific service to rotate (postgres, redis, rabbitmq)").action(async (options) => {
+program.command("secrets:rotate").description("Rotate service passwords").requiredOption("--stage <stage>", "Stage name").option("--service <service>", "Specific service to rotate (postgres, redis, minio, …)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16120,7 +16197,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushStageSecrets } = await Promise.resolve().then(() => require("./transfer-BYIn7z8m.cjs")).then((n) => n.transfer_exports);
+		const { pushStageSecrets } = await Promise.resolve().then(() => transfer_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16135,7 +16212,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullStageSecrets } = await Promise.resolve().then(() => require("./transfer-BYIn7z8m.cjs")).then((n) => n.transfer_exports);
+		const { pullStageSecrets } = await Promise.resolve().then(() => transfer_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16150,8 +16227,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-szmJw_Sb.cjs")).then((n) => n.reconcile_exports);
-		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-DgypfSD6.cjs")).then((n) => n.storage_exports);
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-BxZTV2vl.cjs")).then((n) => n.reconcile_exports);
+		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-C2JC31V9.cjs")).then((n) => n.storage_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets(stage, workspace.root);
@@ -16159,7 +16236,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-DgeVgxmm.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-B3ApLW6p.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16218,7 +16295,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CQflOKKV.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-ZL3RcUVD.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16350,5 +16427,7 @@ Object.defineProperty(exports, "encryption_exports", {
 	}
 });
 exports.getHostingerToken = getHostingerToken;
+exports.isRemoteStore = isRemoteStore;
+exports.pushStageSecrets = pushStageSecrets;
 
 //# sourceMappingURL=index.cjs.map