@geekmidas/cli 10.0.0-alpha.28 → 10.0.0-alpha.29

package/dist/index.mjs

@@ -3,11 +3,11 @@ import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mj
 import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-CXGlQHm1.mjs";
 import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-Dqxa-_Ge.mjs";
 import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-T4IVGSoB.mjs";
-import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
-import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-cBobQVoA.mjs";
+import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-BjTLjDDp.mjs";
+import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-DnHW8ooI.mjs";
 import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, s as OpenApiTsGenerator } from "./openapi-D-Lk5Hr5.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
-import { a as createStageSecrets, c as generateServiceCredentials, i as writeDockerEnvFromSecrets, l as rotateServicePassword, o as generateConnectionUrls, r as generateFullstackCustomSecrets, s as generateSecurePassword, t as reconcileMissingSecrets } from "./reconcile-DhbCvh4K.mjs";
+import { a as createStageSecrets, c as generateServiceCredentials, i as writeDockerEnvFromSecrets, l as rotateServicePassword, o as generateConnectionUrls, r as generateFullstackCustomSecrets, s as generateSecurePassword, t as reconcileMissingSecrets } from "./reconcile-yNq6Shau.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -37,7 +37,7 @@ import { lookup } from "node:dns/promises";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { serviceContext } from "@geekmidas/services";
 //#region package.json
-var version = "10.0.0-alpha.28";
+var version = "10.0.0-alpha.29";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -2901,7 +2901,7 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$8.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-D5RcGmVM.mjs");
+			const { bundleServer } = await import("./bundler-7iaO93G8.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -8121,15 +8121,20 @@ function databaseFiles() {
 	return [{
 		path: "src/constructs/database.ts",
 		content: `import { KyselyDatabase } from '@geekmidas/constructs/database/kysely';
-import type { Generated } from 'kysely';
+import { CamelCasePlugin, type Generated } from 'kysely';
 
-/** Your database schema. Add tables here. */
+/**
+ * Your database schema. Add tables here.
+ *
+ * camelCase, because of the plugin below: the columns are snake_case in
+ * Postgres (\`created_at\`), and Kysely maps between the two.
+ */
 export interface Database {
   users: {
     id: Generated<string>;
     name: string;
     email: string;
-    created_at: Generated<Date>;
+    createdAt: Generated<Date>;
   };
 }
 
@@ -8144,7 +8149,11 @@ export interface Database {
  * inference, so passing only \`Database\` would leave the name at \`string\`
  * and widen the service key away from \`${db.service}\`.
  */
-export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}');
+export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}', {
+  // Yours to keep, change or remove. Every connection this construct opens —
+  // every endpoint, the tests — uses it.
+  plugins: [new CamelCasePlugin()],
+});
 `
 	}, usersMigration()];
 }
@@ -8319,7 +8328,7 @@ environment and fail in a way that looks like a config bug. Go through
 \`gkm exec --\`, which is what injects them.`);
 	if (!isWorker) sections.push(endpointSection(options));
 	if (isWorker || isServerless) sections.push(backgroundSection(template));
-	if (database) sections.push(databaseSection());
+	if (database) sections.push(databaseSection(), queriesSection());
 	sections.push(`## Environment
 
 Environment is parsed once, through \`envkit\`, and never read from
@@ -8506,6 +8515,88 @@ export const monthly = router
 Queries go through Kysely. Never open your own connection pool — the one the
 construct provides is the one that gets credentials, pooling and shutdown.`;
 }
+function queriesSection() {
+	return `## Writing queries and relations
+
+**Names: snake_case in Postgres, camelCase in TypeScript.** Kysely's
+\`CamelCasePlugin\` does the mapping, and it is set where you can see it — on
+the database construct in \`constructs/database.ts\`:
+
+\`\`\`typescript
+export const database = new KyselyDatabase<Database, 'Database'>('Database', {
+  plugins: [new CamelCasePlugin()],
+});
+\`\`\`
+
+It is the project's plugin, not the toolbox's: keep it, change it, or remove it,
+but do it there. It applies to every connection the construct opens: every
+endpoint, and the tests, which connect through the construct.
+
+- The \`Database\` interface is camelCase: \`userId\`, \`createdAt\`.
+- Migrations are the SQL, so they spell columns in snake_case.
+- A raw \`sql\` fragment is not rewritten. Refer to columns with
+  \`sql.ref('users.createdAt')\` or \`eb.ref(…)\`, never inside the string.
+- A schema tenant takes its own options. Better Auth's tenant gets no plugin —
+  its tables are its own.
+
+**Types.** \`Generated<T>\` for every column the database fills in (ids,
+defaults, timestamps). Derive row types with \`Selectable<Database['users']>\`,
+\`Insertable<…>\` and \`Updateable<…>\` rather than writing them again.
+
+**Relations are foreign keys.** Every \`*_id\` column references its parent,
+with its delete rule written out:
+
+\`\`\`typescript
+.addColumn('user_id', 'uuid', (col) =>
+  col.notNull().references('users.id').onDelete('cascade'),
+)
+\`\`\`
+
+- \`restrict\` by default.
+- \`cascade\` only for rows that belong to the parent — a user's notifications.
+- \`set null\` for an optional link, on a nullable column.
+- Index every foreign key column. Postgres does not do it for you.
+
+**Reading related rows: one query, nested.** \`jsonArrayFrom\` and
+\`jsonObjectFrom\` from \`kysely/helpers/postgres\` return children already in
+the shape of the response:
+
+\`\`\`typescript
+import { jsonArrayFrom } from 'kysely/helpers/postgres';
+
+const user = await db
+  .selectFrom('users')
+  .select((eb) => [
+    'users.id',
+    'users.name',
+    jsonArrayFrom(
+      eb
+        .selectFrom('notifications')
+        .select(['notifications.id', 'notifications.body', 'notifications.createdAt'])
+        .whereRef('notifications.userId', '=', 'users.id')
+        .orderBy('notifications.createdAt', 'desc'),
+    ).as('notifications'),
+  ])
+  .where('users.id', '=', id)
+  .executeTakeFirstOrThrow();
+\`\`\`
+
+- Never query once per row in a loop.
+- Use joins to filter, or for a flat result — not to build nested ones by hand.
+- Qualify columns (\`users.id\`) once a query touches more than one table.
+- Select the columns the response needs. \`selectAll()\` only returns a whole
+  row.
+- Nested rows come back as JSON: a timestamp inside \`jsonArrayFrom\` is a
+  string, not a \`Date\`. Say so in the output schema (\`z.coerce.date()\`).
+
+**Writes that touch several tables run in one transaction.** Use
+\`withTransaction(db, async (trx) => …)\` from \`@geekmidas/db/kysely\`: it joins
+the transaction \`db\` already is — an endpoint with an auditor, a test —
+instead of opening a second one.
+
+**Lists paginate by cursor**, with \`paginatedSearch\` from
+\`@geekmidas/db/kysely/pagination\`, not by offset.`;
+}
 function conventionsSection() {
 	return `## Conventions
 
@@ -8680,26 +8771,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.28",
-	"@geekmidas/auth": "~10.0.0-alpha.28",
-	"@geekmidas/cache": "~10.0.0-alpha.28",
-	"@geekmidas/client": "~10.0.0-alpha.28",
-	"@geekmidas/cloud": "~10.0.0-alpha.28",
-	"@geekmidas/constructs": "~10.0.0-alpha.28",
-	"@geekmidas/db": "~10.0.0-alpha.28",
-	"@geekmidas/emailkit": "~10.0.0-alpha.28",
-	"@geekmidas/envkit": "~10.0.0-alpha.28",
-	"@geekmidas/errors": "~10.0.0-alpha.28",
-	"@geekmidas/events": "~10.0.0-alpha.28",
-	"@geekmidas/logger": "~10.0.0-alpha.28",
-	"@geekmidas/manifest": "~10.0.0-alpha.28",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.28",
-	"@geekmidas/schema": "~10.0.0-alpha.28",
-	"@geekmidas/services": "~10.0.0-alpha.28",
-	"@geekmidas/storage": "~10.0.0-alpha.28",
-	"@geekmidas/studio": "~10.0.0-alpha.28",
-	"@geekmidas/telescope": "~10.0.0-alpha.28",
-	"@geekmidas/testkit": "~10.0.0-alpha.28",
+	"@geekmidas/audit": "~10.0.0-alpha.29",
+	"@geekmidas/auth": "~10.0.0-alpha.29",
+	"@geekmidas/cache": "~10.0.0-alpha.29",
+	"@geekmidas/client": "~10.0.0-alpha.29",
+	"@geekmidas/cloud": "~10.0.0-alpha.29",
+	"@geekmidas/constructs": "~10.0.0-alpha.29",
+	"@geekmidas/db": "~10.0.0-alpha.29",
+	"@geekmidas/emailkit": "~10.0.0-alpha.29",
+	"@geekmidas/envkit": "~10.0.0-alpha.29",
+	"@geekmidas/errors": "~10.0.0-alpha.29",
+	"@geekmidas/events": "~10.0.0-alpha.29",
+	"@geekmidas/logger": "~10.0.0-alpha.29",
+	"@geekmidas/manifest": "~10.0.0-alpha.29",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.29",
+	"@geekmidas/schema": "~10.0.0-alpha.29",
+	"@geekmidas/services": "~10.0.0-alpha.29",
+	"@geekmidas/storage": "~10.0.0-alpha.29",
+	"@geekmidas/studio": "~10.0.0-alpha.29",
+	"@geekmidas/telescope": "~10.0.0-alpha.29",
+	"@geekmidas/testkit": "~10.0.0-alpha.29",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10637,15 +10728,20 @@ export const logger = createLogger();
 	files.push({
 		path: "constructs/database.ts",
 		content: `import { KyselyDatabase } from '@geekmidas/constructs/database/kysely';
-import type { Generated } from 'kysely';
+import { CamelCasePlugin, type Generated } from 'kysely';
 
-/** Your database schema. Add tables here. */
+/**
+ * Your database schema. Add tables here.
+ *
+ * camelCase, because of the plugin below: the columns are snake_case in
+ * Postgres (\`created_at\`), and Kysely maps between the two.
+ */
 export interface Database {
   users: {
     id: Generated<string>;
     name: string;
     email: string;
-    created_at: Generated<Date>;
+    createdAt: Generated<Date>;
   };
 }
 
@@ -10656,14 +10752,19 @@ export interface Database {
  * \`${db.urlKey}\` all derive from this line — which is why nothing lists
  * \`postgres\` anywhere.
  */
-export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}');
+export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}', {
+  // Yours to keep, change or remove. Every connection this construct opens —
+  // every endpoint, the tests — uses it.
+  plugins: [new CamelCasePlugin()],
+});
 
 /**
  * The auth server's own schema in that same Postgres, with its own role.
  *
  * A schema tenant rather than a second database: one container, and a role
  * whose \`search_path\` is pinned, so Better Auth's tables cannot collide with
- * the application's.
+ * the application's. It takes its own options: no plugin, because Better
+ * Auth names its own columns.
  */
 export const authDb = database.schema<Record<string, never>, 'AuthDb'>('AuthDb');
 `
@@ -10991,54 +11092,11 @@ export const getUserEndpoint = router
 			}
 		];
 		if (options.monorepo) {
-			files.push({
-				path: "src/services/auth.ts",
-				content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
-
-export interface Session {
-  user: {
-    id: string;
-    email: string;
-    name: string;
-  };
-}
-
-export interface AuthClient {
-  getSession: (cookie: string) => Promise<Session | null>;
-}
-
-export const authService = {
-  serviceName: 'auth' as const,
-  async register({ envParser, context }: ServiceRegisterOptions) {
-    const logger = context.getLogger();
-
-    const config = envParser
-      .create((get) => ({
-        url: get('AUTH_URL').string(),
-      }))
-      .parse();
-
-    logger.info({ authUrl: config.url }, 'Auth service configured');
-
-    return {
-      getSession: async (cookie: string): Promise<Session | null> => {
-        const res = await fetch(\`\${config.url}/api/auth/get-session\`, {
-          headers: { cookie },
-        });
-        if (!res.ok) return null;
-        return (await res.json()) as Session | null;
-      },
-    };
-  },
-} satisfies Service<'auth', AuthClient>;
-`
-			});
 			files.push({
 				path: "src/router.ts",
 				content: `import { UnauthorizedError } from '@geekmidas/errors';
 import { api } from '${constructsImport("api")}';${options.constructs.database ? `
 import { database } from '${constructsImport("database")}';` : ""}
-import { authService, type Session } from './services/auth.ts';
 
 /**
  * The shared endpoint factory — no session required.
@@ -11049,15 +11107,17 @@ import { authService, type Session } from './services/auth.ts';
  */
 export const router = api${options.constructs.database ? ".database(database)" : ""};
 
-// The auth client available, but the session not enforced.
-export const r = router.services([authService]);
-
-// Requires an active session — throws when there is none.
-export const sessionRouter = r.session<Session>(async ({ services, header }) => {
-  const cookie = header('cookie') || '';
-  const session = await services.auth.getSession(cookie);
+/**
+ * Requires an active session — throws when there is none.
+ *
+ * \`auth\` is the construct named in \`.auth()\` on the API, bound to this
+ * request: it asks the auth server whose cookie this is. Handlers built from
+ * this router get whatever this returns as \`session\`.
+ */
+export const sessionRouter = router.session(async ({ auth }) => {
+  const session = await auth.getSession();
 
-  if (!session?.user) {
+  if (!session) {
     throw new UnauthorizedError('No active session');
   }
 
@@ -11144,46 +11204,6 @@ export const email = new Email('${mail.id}', { templates: {} });
  * schema and reached by its role, whatever the target.
  */
 export const cache = new Cache('${kv.id}');
-`
-		});
-		if (options.constructs.database && !declares) files.push({
-			path: "src/services/database.ts",
-			content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
-import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
-
-// Define your database schema
-export interface Database {
-  users: {
-    id: string;
-    name: string;
-    email: string;
-    created_at: Date;
-  };
-}
-
-export const databaseService = {
-  serviceName: 'database' as const,
-  async register({ envParser, context }: ServiceRegisterOptions) {
-    const logger = context.getLogger();
-    logger.info('Connecting to database');
-
-    const config = envParser
-      .create((get) => ({
-        url: get('DATABASE_URL').string(),
-      }))
-      .parse();
-
-    const db = new Kysely<Database>({
-      dialect: new PostgresDialect({
-        pool: new pg.Pool({ connectionString: config.url }),
-      }),
-    });
-
-    logger.info('Database connection established');
-    return db;
-  },
-} satisfies Service<'database', Kysely<Database>>;
 `
 		});
 		if (options.telescope) files.push({
@@ -11202,17 +11222,19 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from '${src(declares ? "constructs/database.ts" : "services/database.ts")}';
+import { type Database, database } from '${declares ? src("constructs/database.ts") : constructsImport("database")}';
 import { envParser } from '${src("config/env.ts")}';
 
 const studioConfig = envParser
   .create((get) => ({
-    databaseUrl: get('${declares ? db.urlKey : "DATABASE_URL"}').string(),
+    databaseUrl: get('${db.urlKey}').string(),
   }))
   .parse();
 
-// Create a Kysely instance for Studio
+// Studio's own client, built the way the construct builds its own — the same
+// plugins — so the browser shows what the app's queries see.
 const db = new Kysely<Database>({
+  ...database.clientConfig,
   dialect: new PostgresDialect({
     pool: new pg.Pool({ connectionString: studioConfig.databaseUrl }),
   }),
@@ -11567,7 +11589,8 @@ const workerTemplate = {
 		"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 		"@geekmidas/events": GEEKMIDAS_VERSIONS["@geekmidas/events"],
 		"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
-		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"]
+		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
+		zod: DEPENDENCY_VERSIONS.zod
 	},
 	devDependencies: {
 		"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
@@ -11626,51 +11649,34 @@ export const config = envParser
 				content: loggerContent
 			},
 			{
-				path: "src/events/types.ts",
-				content: `import type { PublishableMessage } from '@geekmidas/events';
-
-// Define your event types here
-export type AppEvents =
-  | PublishableMessage<'user.created', { userId: string; email: string }>
-  | PublishableMessage<'user.updated', { userId: string; changes: Record<string, unknown> }>
-  | PublishableMessage<'order.placed', { orderId: string; userId: string; total: number }>;
-`
-			},
-			{
-				path: "src/events/publisher.ts",
-				content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
-import { Publisher, type EventPublisher } from '@geekmidas/events';
-import type { AppEvents } from './types.ts';
-
-export const eventsPublisherService = {
-  serviceName: 'events' as const,
-  async register({ envParser, context }: ServiceRegisterOptions) {
-    const logger = context.getLogger();
-    logger.info('Connecting to message broker');
-
-    const config = envParser
-      .create((get) => ({
-        url: get('RABBITMQ_URL').string().default('amqp://localhost:5672'),
-      }))
-      .parse();
-
-    const publisher = await Publisher.fromConnectionString<AppEvents>(
-      \`rabbitmq://\${config.url.replace('amqp://', '')}?exchange=events\`
-    );
+				path: "src/constructs/topics.ts",
+				content: `import { t } from '@geekmidas/constructs/topic';
+import { z } from 'zod';
 
-    logger.info('Message broker connection established');
-    return publisher;
-  },
-} satisfies Service<'events', EventPublisher<AppEvents>>;
+/**
+ * The \`users\` topic: pub/sub fan-out, any number of subscribers.
+ *
+ * The event map is the contract. It types \`users.publisher\` and every
+ * subscriber that binds with \`.topic(users)\`, so an event cannot be published
+ * in one shape and read in another.
+ */
+export const users = t.topic('users').events({
+  'user.created': z.object({ userId: z.string(), email: z.email() }),
+  'user.updated': z.object({
+    userId: z.string(),
+    changes: z.record(z.string(), z.unknown()),
+  }),
+});
 `
 			},
 			{
 				path: "src/subscribers/user-events.ts",
-				content: `import { worker } from '~/constructs/worker.ts';
-import { eventsPublisherService } from '~/events/publisher.ts';
+				content: `import { users } from '~/constructs/topics.ts';
+import { worker } from '~/constructs/worker.ts';
 
+// Bound to the topic, not handed its publisher: a subscriber consumes.
 export const userEventsSubscriber = worker
-  .publisher(eventsPublisherService)
+  .topic(users)
   .subscribe(['user.created', 'user.updated'])
   .handle(async ({ events, logger }) => {
     // A batch, not a single event. Both transports deliver in batches, so
@@ -11976,7 +11982,7 @@ function generateSourceFiles(options, template) {
 function generateTestFiles(options, _template) {
 	if (!options.constructs.database) return [];
 	const db = databaseFor();
-	const schema = !options.monorepo ? "../src/constructs/database.ts" : "~/services/database.ts";
+	const schema = !options.monorepo ? "../src/constructs/database.ts" : `@${options.name}/constructs/database.ts`;
 	const runtimeUrl = db.urlKey;
 	const ownerUrl = db.ownerUrlKey;
 	return [
@@ -12005,21 +12011,13 @@ export default defineConfig({
 		{
 			path: "test/config.ts",
 			content: `import { it as itVitest } from 'vitest';
-import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
 import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
-import type { Database } from '${schema}';
-
-const db = new Kysely<Database>({
-  dialect: new PostgresDialect({
-    pool: new pg.Pool({ connectionString: process.env.${runtimeUrl} }),
-  }),
-});
+import { type Database, database } from '${schema}';
 
 export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
-  // A function, or a construct: an instance is taken for a construct and has
-  // no service to register.
-  connection: () => db,
+  // The construct itself, so the tests connect the way the app does — with
+  // the plugins it was given, \`CamelCasePlugin\` included.
+  connection: database,
 });
 `
 		},
@@ -12093,7 +12091,7 @@ export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
     id: faker.string.uuid(),
     name: faker.person.fullName(),
     email: faker.internet.email(),
-    created_at: new Date(),
+    createdAt: new Date(),
   }),
 );
 `
@@ -14806,7 +14804,6 @@ async function secretsInitCommand(options) {
 	logger$2.log(`  Location: .gkm/secrets/${stage}.json`);
 	if (secrets.urls.DATABASE_URL) logger$2.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
 	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger$2.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) logger$2.log(`\n  Custom secrets: ${Object.keys(secrets.custom).length}`);
 	logger$2.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
@@ -14868,13 +14865,11 @@ async function secretsShowCommand(options) {
 		logger$2.log(`    username: ${creds.username}`);
 		logger$2.log(`    password: ${reveal ? creds.password : maskPassword(creds.password)}`);
 		if (creds.database) logger$2.log(`    database: ${creds.database}`);
-		if (creds.vhost) logger$2.log(`    vhost: ${creds.vhost}`);
 		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
 	}
 	logger$2.log("\nConnection URLs:");
 	if (secrets.urls.DATABASE_URL) logger$2.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
 	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger$2.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) {
 		logger$2.log("\nCustom Secrets:");
@@ -15044,7 +15039,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await import("./workspace-cBobQVoA.mjs").then((n) => n.a);
+	const { derivedContainers } = await import("./workspace-DnHW8ooI.mjs").then((n) => n.a);
 	const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15204,8 +15199,7 @@ function credentialedServices(containers) {
 		redis: "redis",
 		minio: "minio",
 		mailpit: "mailpit",
-		localstack: "localstack",
-		rabbitmq: "rabbitmq"
+		localstack: "localstack"
 	};
 	return [...new Set(containers.map((container) => byContainer[container]).filter((name) => Boolean(name)))];
 }
@@ -15225,7 +15219,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 				[name]: creds
 			}
 		};
-		result.urls = generateConnectionUrls(result.services, result.eventsBackend);
+		result.urls = generateConnectionUrls(result.services);
 		logger$1.log(`   🔄 Adding missing service credentials: ${name}`);
 		changed = true;
 	}
@@ -15243,7 +15237,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 				}
 			}
 		};
-		result.urls = generateConnectionUrls(result.services, result.eventsBackend);
+		result.urls = generateConnectionUrls(result.services);
 		logger$1.log("   🔄 Adding missing service credentials: pgboss");
 		changed = true;
 	}
@@ -16167,7 +16161,7 @@ program.command("secrets:show").description("Show secrets for a stage").required
 		process.exit(1);
 	}
 });
-program.command("secrets:rotate").description("Rotate service passwords").requiredOption("--stage <stage>", "Stage name").option("--service <service>", "Specific service to rotate (postgres, redis, rabbitmq)").action(async (options) => {
+program.command("secrets:rotate").description("Rotate service passwords").requiredOption("--stage <stage>", "Stage name").option("--service <service>", "Specific service to rotate (postgres, redis, minio, …)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16222,8 +16216,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DhbCvh4K.mjs").then((n) => n.n);
-		const { readStageSecrets, writeStageSecrets } = await import("./storage-TP0x118M.mjs").then((n) => n.a);
+		const { reconcileMissingSecrets } = await import("./reconcile-yNq6Shau.mjs").then((n) => n.n);
+		const { readStageSecrets, writeStageSecrets } = await import("./storage-BjTLjDDp.mjs").then((n) => n.a);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets(stage, workspace.root);
@@ -16231,7 +16225,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-cBobQVoA.mjs").then((n) => n.a);
+		const { derivedContainers } = await import("./workspace-DnHW8ooI.mjs").then((n) => n.a);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16290,7 +16284,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-zkzu-ka2.mjs");
+		const { deployGithubCommand } = await import("./github-DPpNfzu4.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));