@geekmidas/cli 10.0.0-alpha.36 → 10.0.0-alpha.38

package/dist/index.cjs

@@ -2,15 +2,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-CroTIm0K.cjs");
-const require_config = require("./config-DgAHy8nY.cjs");
-const require_workspace = require("./workspace-CAJk6UmC.cjs");
-const require_storage = require("./storage-C2JC31V9.cjs");
-const require_workspace$1 = require("./workspace-C0X8xSXV.cjs");
+const require_config = require("./config-j4krJZVq.cjs");
+const require_workspace = require("./workspace-RYSYtHP7.cjs");
+const require_storage = require("./storage-CSGoC3bK.cjs");
+const require_store = require("./store-DQgxT_WR.cjs");
+const require_workspace$1 = require("./workspace-gfIrSEUp.cjs");
 const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-D1nhN98m.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-CXhoutix.cjs");
+const require_ready = require("./ready-DxC0Z3No.cjs");
 const require_emit = require("./emit-BdoPFjZf.cjs");
-const require_reconcile = require("./reconcile-BxZTV2vl.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
 let node_readline_promises = require("node:readline/promises");
@@ -35,6 +35,11 @@ let node_util = require("node:util");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let prompts = require("prompts");
 prompts = require_rolldown_runtime.__toESM(prompts, 1);
+let http = require("http");
+let http2 = require("http2");
+let stream = require("stream");
+let crypto = require("crypto");
+crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_crons = require("@geekmidas/constructs/crons");
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
@@ -42,7 +47,7 @@ let _geekmidas_constructs_subscribers = require("@geekmidas/constructs/subscribe
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.36";
+var version = "10.0.0-alpha.38";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -583,6 +588,485 @@ var UnsupportedPlatform = class extends Error {
 	}
 };
 //#endregion
+//#region ../../node_modules/.pnpm/@hono+node-server@1.19.5_hono@4.13.8/node_modules/@hono/node-server/dist/index.mjs
+var RequestError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "RequestError";
+	}
+};
+var toRequestError = (e) => {
+	if (e instanceof RequestError) return e;
+	return new RequestError(e.message, { cause: e });
+};
+var GlobalRequest = global.Request;
+var Request = class extends GlobalRequest {
+	constructor(input, options) {
+		if (typeof input === "object" && getRequestCache in input) input = input[getRequestCache]();
+		if (typeof options?.body?.getReader !== "undefined") options.duplex ??= "half";
+		super(input, options);
+	}
+};
+var newHeadersFromIncoming = (incoming) => {
+	const headerRecord = [];
+	const rawHeaders = incoming.rawHeaders;
+	for (let i = 0; i < rawHeaders.length; i += 2) {
+		const { [i]: key, [i + 1]: value } = rawHeaders;
+		if (key.charCodeAt(0) !== 58) headerRecord.push([key, value]);
+	}
+	return new Headers(headerRecord);
+};
+var wrapBodyStream = Symbol("wrapBodyStream");
+var newRequestFromIncoming = (method, url, headers, incoming, abortController) => {
+	const init = {
+		method,
+		headers,
+		signal: abortController.signal
+	};
+	if (method === "TRACE") {
+		init.method = "GET";
+		const req = new Request(url, init);
+		Object.defineProperty(req, "method", { get() {
+			return "TRACE";
+		} });
+		return req;
+	}
+	if (!(method === "GET" || method === "HEAD")) {
+		if ("rawBody" in incoming && incoming.rawBody instanceof Buffer) init.body = new ReadableStream({ start(controller) {
+			controller.enqueue(incoming.rawBody);
+			controller.close();
+		} });
+		else if (incoming[wrapBodyStream]) {
+			let reader;
+			init.body = new ReadableStream({ async pull(controller) {
+				try {
+					reader ||= stream.Readable.toWeb(incoming).getReader();
+					const { done, value } = await reader.read();
+					if (done) controller.close();
+					else controller.enqueue(value);
+				} catch (error) {
+					controller.error(error);
+				}
+			} });
+		} else init.body = stream.Readable.toWeb(incoming);
+	}
+	return new Request(url, init);
+};
+var getRequestCache = Symbol("getRequestCache");
+var requestCache = Symbol("requestCache");
+var incomingKey = Symbol("incomingKey");
+var urlKey = Symbol("urlKey");
+var headersKey = Symbol("headersKey");
+var abortControllerKey = Symbol("abortControllerKey");
+var requestPrototype = {
+	get method() {
+		return this[incomingKey].method || "GET";
+	},
+	get url() {
+		return this[urlKey];
+	},
+	get headers() {
+		return this[headersKey] ||= newHeadersFromIncoming(this[incomingKey]);
+	},
+	[Symbol("getAbortController")]() {
+		this[getRequestCache]();
+		return this[abortControllerKey];
+	},
+	[getRequestCache]() {
+		this[abortControllerKey] ||= new AbortController();
+		return this[requestCache] ||= newRequestFromIncoming(this.method, this[urlKey], this.headers, this[incomingKey], this[abortControllerKey]);
+	}
+};
+[
+	"body",
+	"bodyUsed",
+	"cache",
+	"credentials",
+	"destination",
+	"integrity",
+	"mode",
+	"redirect",
+	"referrer",
+	"referrerPolicy",
+	"signal",
+	"keepalive"
+].forEach((k) => {
+	Object.defineProperty(requestPrototype, k, { get() {
+		return this[getRequestCache]()[k];
+	} });
+});
+[
+	"arrayBuffer",
+	"blob",
+	"clone",
+	"formData",
+	"json",
+	"text"
+].forEach((k) => {
+	Object.defineProperty(requestPrototype, k, { value: function() {
+		return this[getRequestCache]()[k]();
+	} });
+});
+Object.setPrototypeOf(requestPrototype, Request.prototype);
+var newRequest = (incoming, defaultHostname) => {
+	const req = Object.create(requestPrototype);
+	req[incomingKey] = incoming;
+	const incomingUrl = incoming.url || "";
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		if (incoming instanceof http2.Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
+		try {
+			req[urlKey] = new URL(incomingUrl).href;
+		} catch (e) {
+			throw new RequestError("Invalid absolute URL", { cause: e });
+		}
+		return req;
+	}
+	const host = (incoming instanceof http2.Http2ServerRequest ? incoming.authority : incoming.headers.host) || defaultHostname;
+	if (!host) throw new RequestError("Missing host header");
+	let scheme;
+	if (incoming instanceof http2.Http2ServerRequest) {
+		scheme = incoming.scheme;
+		if (!(scheme === "http" || scheme === "https")) throw new RequestError("Unsupported scheme");
+	} else scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
+	const url = new URL(`${scheme}://${host}${incomingUrl}`);
+	if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) throw new RequestError("Invalid host header");
+	req[urlKey] = url.href;
+	return req;
+};
+var responseCache = Symbol("responseCache");
+var getResponseCache = Symbol("getResponseCache");
+var cacheKey = Symbol("cache");
+var GlobalResponse = global.Response;
+var Response2 = class _Response {
+	#body;
+	#init;
+	[getResponseCache]() {
+		delete this[cacheKey];
+		return this[responseCache] ||= new GlobalResponse(this.#body, this.#init);
+	}
+	constructor(body, init) {
+		let headers;
+		this.#body = body;
+		if (init instanceof _Response) {
+			const cachedGlobalResponse = init[responseCache];
+			if (cachedGlobalResponse) {
+				this.#init = cachedGlobalResponse;
+				this[getResponseCache]();
+				return;
+			} else {
+				this.#init = init.#init;
+				headers = new Headers(init.#init.headers);
+			}
+		} else this.#init = init;
+		if (typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) {
+			headers ||= init?.headers || { "content-type": "text/plain; charset=UTF-8" };
+			this[cacheKey] = [
+				init?.status || 200,
+				body,
+				headers
+			];
+		}
+	}
+	get headers() {
+		const cache = this[cacheKey];
+		if (cache) {
+			if (!(cache[2] instanceof Headers)) cache[2] = new Headers(cache[2]);
+			return cache[2];
+		}
+		return this[getResponseCache]().headers;
+	}
+	get status() {
+		return this[cacheKey]?.[0] ?? this[getResponseCache]().status;
+	}
+	get ok() {
+		const status = this.status;
+		return status >= 200 && status < 300;
+	}
+};
+[
+	"body",
+	"bodyUsed",
+	"redirected",
+	"statusText",
+	"trailers",
+	"type",
+	"url"
+].forEach((k) => {
+	Object.defineProperty(Response2.prototype, k, { get() {
+		return this[getResponseCache]()[k];
+	} });
+});
+[
+	"arrayBuffer",
+	"blob",
+	"clone",
+	"formData",
+	"json",
+	"text"
+].forEach((k) => {
+	Object.defineProperty(Response2.prototype, k, { value: function() {
+		return this[getResponseCache]()[k]();
+	} });
+});
+Object.setPrototypeOf(Response2, GlobalResponse);
+Object.setPrototypeOf(Response2.prototype, GlobalResponse.prototype);
+async function readWithoutBlocking(readPromise) {
+	return Promise.race([readPromise, Promise.resolve().then(() => Promise.resolve(void 0))]);
+}
+function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromise) {
+	const cancel = (error) => {
+		reader.cancel(error).catch(() => {});
+	};
+	writable.on("close", cancel);
+	writable.on("error", cancel);
+	(currentReadPromise ?? reader.read()).then(flow, handleStreamError);
+	return reader.closed.finally(() => {
+		writable.off("close", cancel);
+		writable.off("error", cancel);
+	});
+	function handleStreamError(error) {
+		if (error) writable.destroy(error);
+	}
+	function onDrain() {
+		reader.read().then(flow, handleStreamError);
+	}
+	function flow({ done, value }) {
+		try {
+			if (done) writable.end();
+			else if (!writable.write(value)) writable.once("drain", onDrain);
+			else return reader.read().then(flow, handleStreamError);
+		} catch (e) {
+			handleStreamError(e);
+		}
+	}
+}
+function writeFromReadableStream(stream$1, writable) {
+	if (stream$1.locked) throw new TypeError("ReadableStream is locked.");
+	else if (writable.destroyed) return;
+	return writeFromReadableStreamDefaultReader(stream$1.getReader(), writable);
+}
+var buildOutgoingHttpHeaders = (headers) => {
+	const res = {};
+	if (!(headers instanceof Headers)) headers = new Headers(headers ?? void 0);
+	const cookies = [];
+	for (const [k, v] of headers) if (k === "set-cookie") cookies.push(v);
+	else res[k] = v;
+	if (cookies.length > 0) res["set-cookie"] = cookies;
+	res["content-type"] ??= "text/plain; charset=UTF-8";
+	return res;
+};
+var X_ALREADY_SENT = "x-hono-already-sent";
+var webFetch = global.fetch;
+if (typeof global.crypto === "undefined") global.crypto = crypto.default;
+global.fetch = (info, init) => {
+	init = {
+		compress: false,
+		...init
+	};
+	return webFetch(info, init);
+};
+var outgoingEnded = Symbol("outgoingEnded");
+var handleRequestError = () => new Response(null, { status: 400 });
+var handleFetchError = (e) => new Response(null, { status: e instanceof Error && (e.name === "TimeoutError" || e.constructor.name === "TimeoutError") ? 504 : 500 });
+var handleResponseError = (e, outgoing) => {
+	const err = e instanceof Error ? e : new Error("unknown error", { cause: e });
+	if (err.code === "ERR_STREAM_PREMATURE_CLOSE") console.info("The user aborted a request.");
+	else {
+		console.error(e);
+		if (!outgoing.headersSent) outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		outgoing.end(`Error: ${err.message}`);
+		outgoing.destroy(err);
+	}
+};
+var flushHeaders = (outgoing) => {
+	if ("flushHeaders" in outgoing && outgoing.writable) outgoing.flushHeaders();
+};
+var responseViaCache = async (res, outgoing) => {
+	let [status, body, header] = res[cacheKey];
+	if (header instanceof Headers) header = buildOutgoingHttpHeaders(header);
+	if (typeof body === "string") header["Content-Length"] = Buffer.byteLength(body);
+	else if (body instanceof Uint8Array) header["Content-Length"] = body.byteLength;
+	else if (body instanceof Blob) header["Content-Length"] = body.size;
+	outgoing.writeHead(status, header);
+	if (typeof body === "string" || body instanceof Uint8Array) outgoing.end(body);
+	else if (body instanceof Blob) outgoing.end(new Uint8Array(await body.arrayBuffer()));
+	else {
+		flushHeaders(outgoing);
+		await writeFromReadableStream(body, outgoing)?.catch((e) => handleResponseError(e, outgoing));
+	}
+	outgoing[outgoingEnded]?.();
+};
+var isPromise = (res) => typeof res.then === "function";
+var responseViaResponseObject = async (res, outgoing, options = {}) => {
+	if (isPromise(res)) {
+		if (options.errorHandler) try {
+			res = await res;
+		} catch (err) {
+			const errRes = await options.errorHandler(err);
+			if (!errRes) return;
+			res = errRes;
+		}
+		else res = await res.catch(handleFetchError);
+	}
+	if (cacheKey in res) return responseViaCache(res, outgoing);
+	const resHeaderRecord = buildOutgoingHttpHeaders(res.headers);
+	if (res.body) {
+		const reader = res.body.getReader();
+		const values = [];
+		let done = false;
+		let currentReadPromise = void 0;
+		if (resHeaderRecord["transfer-encoding"] !== "chunked") {
+			let maxReadCount = 2;
+			for (let i = 0; i < maxReadCount; i++) {
+				currentReadPromise ||= reader.read();
+				const chunk = await readWithoutBlocking(currentReadPromise).catch((e) => {
+					console.error(e);
+					done = true;
+				});
+				if (!chunk) {
+					if (i === 1) {
+						await new Promise((resolve) => setTimeout(resolve));
+						maxReadCount = 3;
+						continue;
+					}
+					break;
+				}
+				currentReadPromise = void 0;
+				if (chunk.value) values.push(chunk.value);
+				if (chunk.done) {
+					done = true;
+					break;
+				}
+			}
+			if (done && !("content-length" in resHeaderRecord)) resHeaderRecord["content-length"] = values.reduce((acc, value) => acc + value.length, 0);
+		}
+		outgoing.writeHead(res.status, resHeaderRecord);
+		values.forEach((value) => {
+			outgoing.write(value);
+		});
+		if (done) outgoing.end();
+		else {
+			if (values.length === 0) flushHeaders(outgoing);
+			await writeFromReadableStreamDefaultReader(reader, outgoing, currentReadPromise);
+		}
+	} else if (resHeaderRecord[X_ALREADY_SENT]) {} else {
+		outgoing.writeHead(res.status, resHeaderRecord);
+		outgoing.end();
+	}
+	outgoing[outgoingEnded]?.();
+};
+var getRequestListener = (fetchCallback, options = {}) => {
+	const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
+	if (options.overrideGlobalObjects !== false && global.Request !== Request) {
+		Object.defineProperty(global, "Request", { value: Request });
+		Object.defineProperty(global, "Response", { value: Response2 });
+	}
+	return async (incoming, outgoing) => {
+		let res, req;
+		try {
+			req = newRequest(incoming, options.hostname);
+			let incomingEnded = !autoCleanupIncoming || incoming.method === "GET" || incoming.method === "HEAD";
+			if (!incomingEnded) {
+				incoming[wrapBodyStream] = true;
+				incoming.on("end", () => {
+					incomingEnded = true;
+				});
+				if (incoming instanceof http2.Http2ServerRequest) outgoing[outgoingEnded] = () => {
+					if (!incomingEnded) setTimeout(() => {
+						if (!incomingEnded) setTimeout(() => {
+							incoming.destroy();
+							outgoing.destroy();
+						});
+					});
+				};
+			}
+			outgoing.on("close", () => {
+				if (req[abortControllerKey]) {
+					if (incoming.errored) req[abortControllerKey].abort(incoming.errored.toString());
+					else if (!outgoing.writableFinished) req[abortControllerKey].abort("Client connection prematurely closed.");
+				}
+				if (!incomingEnded) setTimeout(() => {
+					if (!incomingEnded) setTimeout(() => {
+						incoming.destroy();
+					});
+				});
+			});
+			res = fetchCallback(req, {
+				incoming,
+				outgoing
+			});
+			if (cacheKey in res) return responseViaCache(res, outgoing);
+		} catch (e) {
+			if (!res) {
+				if (options.errorHandler) {
+					res = await options.errorHandler(req ? e : toRequestError(e));
+					if (!res) return;
+				} else if (!req) res = handleRequestError();
+				else res = handleFetchError(e);
+			} else return handleResponseError(e, outgoing);
+		}
+		try {
+			return await responseViaResponseObject(res, outgoing, options);
+		} catch (e) {
+			return handleResponseError(e, outgoing);
+		}
+	};
+};
+var createAdaptorServer = (options) => {
+	const fetchCallback = options.fetch;
+	const requestListener = getRequestListener(fetchCallback, {
+		hostname: options.hostname,
+		overrideGlobalObjects: options.overrideGlobalObjects,
+		autoCleanupIncoming: options.autoCleanupIncoming
+	});
+	return (options.createServer || http.createServer)(options.serverOptions || {}, requestListener);
+};
+var serve = (options, listeningListener) => {
+	const server = createAdaptorServer(options);
+	server.listen(options?.port ?? 3e3, options.hostname, () => {
+		const serverInfo = server.address();
+		listeningListener && listeningListener(serverInfo);
+	});
+	return server;
+};
+//#endregion
+//#region src/dev/fakes.ts
+/**
+* External APIs' app fakes, served for `gkm dev`.
+*
+* An image fake runs with the other containers. An app fake is a fetch handler
+* in `test/fakes/<id>.ts`, and nothing runs it unless this does: each one
+* listens on the port its key was allocated, which is the port the stage's
+* `<ID>_URL` already names.
+*/
+/**
+* Serve every app fake on its allocated port. Image fakes are skipped — their
+* containers are already up.
+*/
+async function serveFakes(fakes, ports) {
+	const served = [];
+	for (const [id, local] of Object.entries(fakes)) {
+		if (local.image) continue;
+		const port = ports[require_workspace$1.fakeKey(id)];
+		if (port === void 0) continue;
+		const { handler } = (await import((0, node_url.pathToFileURL)(local.file).href)).default;
+		const server = serve({
+			fetch: (request) => handler.fetch(request),
+			port
+		});
+		served.push({
+			id,
+			port,
+			server
+		});
+	}
+	return served;
+}
+/** Stop every served fake. */
+function closeFakes(served) {
+	for (const { server } of served) server.close();
+}
+//#endregion
 //#region src/exec/index.ts
 const logger$11 = console;
 /** `gkm exec` was given nothing to run. */
@@ -734,41 +1218,28 @@ async function devCommand(options) {
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const appName = require_config.getAppNameFromCwd();
-	let config;
-	let appRoot = process.cwd();
-	let secretsRoot = process.cwd();
-	let workspaceAppName;
-	let workspaceAppPort;
-	let workspace;
-	if (appName) try {
-		const appConfig = await require_config.loadAppConfig();
-		config = appConfig.gkmConfig;
-		appRoot = appConfig.appRoot;
-		secretsRoot = appConfig.workspaceRoot;
-		workspaceAppName = appConfig.appName;
-		workspaceAppPort = appConfig.app.port;
-		workspace = appConfig.workspace;
-		if (appConfig.app.entry) {
-			logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
-			return entryDevCommand({
-				...options,
-				entry: appConfig.app.entry,
-				port: workspaceAppPort,
-				portExplicit: true
-			});
-		}
-	} catch {
-		const loadedConfig = await require_config.loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") return workspaceDevCommand(loadedConfig.workspace, options);
-		config = loadedConfig.raw;
-		workspace = loadedConfig.workspace;
-	}
-	else {
-		const loadedConfig = await require_config.loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") return workspaceDevCommand(loadedConfig.workspace, options);
-		config = loadedConfig.raw;
-		workspace = loadedConfig.workspace;
+	const appConfig = await require_config.loadAppConfig().catch((error) => {
+		if (error instanceof require_config.NotInAnApp || error instanceof require_config.NotABackendApp) return;
+		throw error;
+	});
+	if (!appConfig) {
+		const { workspace: everything } = await require_config.loadWorkspaceConfig();
+		return workspaceDevCommand(everything, options);
+	}
+	const config = appConfig.gkmConfig;
+	const appRoot = appConfig.appRoot;
+	const secretsRoot = appConfig.workspaceRoot;
+	const workspaceAppName = appConfig.appName;
+	const workspaceAppPort = appConfig.app.port;
+	const workspace = appConfig.workspace;
+	if (appConfig.app.entry) {
+		logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
+		return entryDevCommand({
+			...options,
+			entry: appConfig.app.entry,
+			port: workspaceAppPort,
+			portExplicit: true
+		});
 	}
 	if (config.env) {
 		const { loaded, missing } = require_workspace$1.loadEnvFiles(config.env, appRoot);
@@ -798,9 +1269,12 @@ async function devCommand(options) {
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	let publicUrl;
-	const appSecrets = await require_workspace$1.loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
+	const appSecrets = await require_workspace$1.loadSecretsForApp(workspace ? await require_store.secretsStoreFor(workspace, config.stages.local) : new require_store.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
 	if (workspace) {
-		const reconciled = await require_workspace$1.reconcileWorkspace(workspace, { stage: workspace.stages.local });
+		const reconciled = await require_workspace$1.reconcileWorkspace(workspace, {
+			stage: workspace.stages.local,
+			...options.fake ? { fake: true } : {}
+		});
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
@@ -821,7 +1295,7 @@ async function devCommand(options) {
 	devServer.publicUrl = publicUrl;
 	await devServer.start();
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
-	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
+	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => (0, node_path.isAbsolute)(p) ? (0, node_path.relative)(appRoot, p) : p.replace(/^\.\//, ""));
 	const resolvedFiles = await (0, fast_glob.default)(normalizedPatterns, {
 		cwd: appRoot,
 		absolute: false,
@@ -1045,10 +1519,8 @@ async function validateFrontendApps(workspace) {
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
 	const stage = workspace.stages.local;
-	if (require_storage.secretsExist(stage, workspace.root)) {
-		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
-		if (secrets) return require_storage.toEmbeddableSecrets(secrets);
-	}
+	const secrets = await (await require_store.secretsStoreFor(workspace, stage)).read(stage);
+	if (secrets) return require_storage.toEmbeddableSecrets(secrets);
 	return {};
 }
 /**
@@ -1082,7 +1554,10 @@ async function workspaceDevCommand(workspace, options) {
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	const reconciled = await require_workspace$1.reconcileWorkspace(workspace, { stage: workspace.stages.local });
+	const reconciled = await require_workspace$1.reconcileWorkspace(workspace, {
+		stage: workspace.stages.local,
+		...options.fake ? { fake: true } : {}
+	});
 	if (reconciled.changed && reconciled.plan.containers.length > 0) {
 		logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 		for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
@@ -1091,10 +1566,12 @@ async function workspaceDevCommand(workspace, options) {
 		...rawSecrets,
 		...reconciled.env
 	};
+	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
+	for (const { id, port } of fakes) logger$10.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BsW4xBEO.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DKn83skp.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-BsW4xBEO.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DKn83skp.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1153,7 +1630,8 @@ async function workspaceDevCommand(workspace, options) {
 		...process.env,
 		...secretsEnv,
 		NODE_ENV: "development",
-		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
+		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
+		...options.fake ? { [require_workspace$1.FAKE_ENV]: "1" } : {}
 	};
 	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(workspace.apps);
 	const held = [];
@@ -1182,6 +1660,7 @@ async function workspaceDevCommand(workspace, options) {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
 		logger$10.log("\n🛑 Shutting down workspace...");
+		closeFakes(fakes);
 		const pid = turboProcess.pid;
 		if (pid) try {
 			process.kill(-pid, "SIGTERM");
@@ -2814,7 +3293,7 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$8.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CYF5mWi9.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-By6_sXiL.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3298,17 +3777,43 @@ const PROVISIONERS = {
 		return broker(declaration.id, context);
 	},
 	/**
-	* A signing key, generated once and remembered.
+	* A signing key, generated once and remembered in the stage's store.
 	*
-	* Regenerating it on every deploy would invalidate every live session, which
-	* is why the value comes from state when there is one. Nothing is created in
-	* Dokploy: a secret has no address.
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
 	*/
 	secret: async (declaration, context) => {
 		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
 		const key = declaration.provides?.[0];
 		if (!key) return { provides: {} };
-		return { provides: { [key]: context.secrets?.[key] ?? derivedPassword(context, `secret:${declaration.id}`) } };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: (0, _geekmidas_manifest.externalApiUrl)(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
 	},
 	/**
 	* A surface, at the address whatever created its domain assigned.
@@ -3495,14 +4000,16 @@ function soleDatabase(context) {
 	return databases[0];
 }
 /**
-* A password derived from the project, the stage and the role.
+* A password derived from the stage's seed, the project, the stage and the role.
 *
-* Derived rather than random for the reason the local target derives its own: a
-* redeploy must not lock the running application out of its own database, and
-* two projects must not share a credential.
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
 */
 function derivedPassword(context, role) {
-	return (0, node_crypto.createHash)("sha256").update(`${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+	return (0, node_crypto.createHash)("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
 }
 /** A connection string for a role on a cluster. */
 function postgresUrl(role, password, host, database) {
@@ -3513,6 +4020,29 @@ function quoted(name) {
 	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
 }
 /** A provisioner was handed a declaration of the wrong kind. */
+/**
+* A value only the stage's own secrets can hold.
+*
+* @throws {MissingSuppliedSecret} when the stage was never given it.
+*/
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
+}
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends Error {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
 var WrongKind = class extends Error {
 	kind;
 	constructor(kind) {
@@ -3635,7 +4165,8 @@ async function provisionDeclared(options) {
 		events: require_workspace$1.eventsBackendFor(require_workspace$1.providerOf(workspace)),
 		storage: require_workspace$1.storageBackendFor(require_workspace$1.providerOf(workspace)),
 		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
-		...options.secrets ? { secrets: options.secrets } : {},
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
 		deferred: [],
 		clusters: {}
 	};
@@ -4665,14 +5196,9 @@ exec "$@"
 */
 function resolveDockerConfig(config) {
 	const docker = config.docker ?? {};
-	let defaultImageName = "api";
-	try {
-		const pkg = require(`${process.cwd()}/package.json`);
-		if (pkg.name) defaultImageName = pkg.name.replace(/^@[^/]+\//, "");
-	} catch {}
 	return {
 		registry: docker.registry ?? "",
-		imageName: docker.imageName ?? defaultImageName,
+		imageName: docker.imageName ?? config.name ?? "api",
 		baseImage: docker.baseImage ?? "node:22-alpine",
 		port: docker.port ?? 3e3
 	};
@@ -6265,6 +6791,55 @@ function validateEnvVars(requiredVars, context) {
 	};
 }
 //#endregion
+//#region src/deploy/generated.ts
+/**
+* The values a deployed stage generates once and keeps: what nothing can
+* provision and nobody else issues.
+*
+* - **A seed**, which salts every password a deploy derives — a database's
+*   master and roles, a bucket's root user. Derived from repo facts alone
+*   (project, stage, construct id), those passwords were computable by anyone
+*   who could read the repo.
+* - **Each `secret` construct's value** — an auth server's signing secret —
+*   random, rather than derived.
+*
+* Both are generated on the first deploy that needs them and written to the
+* stage's store, so every later deploy reads the same values: sessions survive
+* a redeploy, and a role's password does not move. A value set by hand with
+* `gkm secrets:set` is kept, never replaced.
+*/
+/**
+* The stage's secrets with its seed and every declared `secret`'s value
+* present, generating what is missing. Pure: the caller writes the result
+* back to the stage's store when `generated` is not empty.
+*/
+function withGeneratedSecrets(secrets, manifest) {
+	const generated = [];
+	const custom = { ...secrets.custom };
+	for (const declaration of Object.values(manifest)) {
+		if (declaration?.kind !== "secret") continue;
+		const key = declaration.provides?.[0];
+		if (!key || custom[key]) continue;
+		custom[key] = random();
+		generated.push(key);
+	}
+	const seed = secrets.seed ?? random();
+	if (!secrets.seed) generated.push("seed");
+	return {
+		secrets: generated.length ? {
+			...secrets,
+			seed,
+			custom,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : secrets,
+		generated
+	};
+}
+/** 256 bits, URL-safe. */
+function random() {
+	return (0, node_crypto.randomBytes)(32).toString("base64url");
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -7083,10 +7658,13 @@ async function workspaceDeployCommand(configured, options) {
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
 	logger$4.log("\n🔐 Loading secrets and analyzing environment requirements...");
-	const stageSecrets = await require_storage.readStageSecrets(stage, workspace.root);
-	if (!stageSecrets) {
-		logger$4.log(`   ⚠️  No secrets found for stage "${stage}"`);
-		logger$4.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
+	const secretsStore = await require_store.secretsStoreFor(workspace, stage);
+	const stored = await secretsStore.read(stage);
+	if (!stored) logger$4.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
+	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
+	if (generated.length > 0) {
+		await secretsStore.write(stage, stageSecrets);
+		logger$4.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
 	}
 	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
@@ -7214,6 +7792,8 @@ async function workspaceDeployCommand(configured, options) {
 			environmentId,
 			stage,
 			appUrls,
+			supplied: stageSecrets.custom,
+			seed: stageSecrets.seed,
 			manifest
 		});
 		declaredEnv = declared.env;
@@ -7974,6 +8554,172 @@ function printStateDetails(state) {
 	}
 }
 //#endregion
+//#region src/secrets/generator.ts
+/**
+* Generate a secure random password using URL-safe base64 characters.
+* @param length Password length (default: 32)
+*/
+function generateSecurePassword(length = 32) {
+	return (0, node_crypto.randomBytes)(Math.ceil(length * 3 / 4)).toString("base64url").slice(0, length);
+}
+/** Default service configurations (localhost for local dev via Docker port mapping) */
+const SERVICE_DEFAULTS = {
+	postgres: {
+		host: "localhost",
+		port: 5432,
+		username: "app",
+		database: "app"
+	},
+	redis: {
+		host: "localhost",
+		port: 6379,
+		username: "default"
+	},
+	minio: {
+		host: "localhost",
+		port: 9e3,
+		username: "app",
+		bucket: "app"
+	},
+	mailpit: {
+		host: "localhost",
+		port: 1025,
+		username: "app"
+	},
+	localstack: {
+		host: "localhost",
+		port: 4566,
+		username: "localstack",
+		region: "us-east-1"
+	}
+};
+/** Default credentials for pgboss (not a Docker service, reuses postgres) */
+const PGBOSS_DEFAULTS = {
+	host: "localhost",
+	port: 5432,
+	username: "pgboss",
+	database: "app"
+};
+/**
+* Generate credentials for a specific service.
+*/
+function generateServiceCredentials(service) {
+	return {
+		...SERVICE_DEFAULTS[service],
+		password: generateSecurePassword()
+	};
+}
+/**
+* Generate credentials for multiple services.
+*/
+function generateServicesCredentials(services) {
+	const result = {};
+	for (const service of services) result[service] = generateServiceCredentials(service);
+	return result;
+}
+/**
+* Generate connection URL for PostgreSQL.
+*/
+function generatePostgresUrl(creds) {
+	const { username, password, host, port, database } = creds;
+	return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
+}
+/**
+* Generate connection URL for Redis.
+*/
+function generateRedisUrl(creds) {
+	const { password, host, port } = creds;
+	return `redis://:${encodeURIComponent(password)}@${host}:${port}`;
+}
+/**
+* Generate endpoint URL for MinIO (S3-compatible).
+*/
+function generateMinioEndpoint(creds) {
+	const { host, port } = creds;
+	return `http://${host}:${port}`;
+}
+/**
+* Generate connection URL for pg-boss (uses PostgreSQL protocol).
+* Format: pgboss://user:pass@host:port/db?schema=pgboss
+*/
+function generatePgBossUrl(creds) {
+	const { username, password, host, port, database } = creds;
+	return `pgboss://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=pgboss`;
+}
+/**
+* Generate connection URLs from service credentials.
+*/
+function generateConnectionUrls(services) {
+	const urls = {};
+	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
+	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
+	if (services.minio) urls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);
+	if (services.pgboss) {
+		const pgbossUrl = generatePgBossUrl(services.pgboss);
+		urls.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
+		urls.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
+	}
+	if (services.mailpit) {
+		urls.SMTP_HOST = services.mailpit.host;
+		urls.SMTP_PORT = String(services.mailpit.port);
+	}
+	return urls;
+}
+/**
+* Create a new StageSecrets object with generated credentials.
+* @param stage - The deployment stage (e.g., 'development', 'production')
+* @param services - List of services to generate credentials for
+* @param options - Optional configuration
+* @param options.projectName - Project name used to derive the database name (e.g., 'myapp' → 'myapp_dev')
+*/
+function createStageSecrets(stage, services, options) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const serviceCredentials = generateServicesCredentials(services);
+	if (options?.projectName) {
+		if (serviceCredentials.postgres) serviceCredentials.postgres.database = `${options.projectName.replace(/-/g, "_")}_dev`;
+		if (serviceCredentials.minio) {
+			serviceCredentials.minio.bucket = options.projectName;
+			serviceCredentials.minio.username = options.projectName;
+		}
+	}
+	if (serviceCredentials.postgres && !serviceCredentials.pgboss) serviceCredentials.pgboss = {
+		...PGBOSS_DEFAULTS,
+		password: generateSecurePassword(),
+		host: serviceCredentials.postgres.host,
+		port: serviceCredentials.postgres.port,
+		database: serviceCredentials.postgres.database
+	};
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: serviceCredentials,
+		urls: generateConnectionUrls(serviceCredentials),
+		custom: {}
+	};
+}
+/**
+* Rotate password for a specific service.
+*/
+function rotateServicePassword(secrets, service) {
+	const currentCreds = secrets.services[service];
+	if (!currentCreds) throw new Error(`Service "${service}" not configured in secrets`);
+	const newCreds = {
+		...currentCreds,
+		password: generateSecurePassword()
+	};
+	const newServices = {
+		...secrets.services,
+		[service]: newCreds
+	};
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		services: newServices,
+		urls: generateConnectionUrls(newServices)
+	};
+}
+//#endregion
 //#region src/migrate/names.ts
 /**
 * What a migration file is called: a UTC timestamp, then a name.
@@ -8809,26 +9555,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.36",
-	"@geekmidas/auth": "~10.0.0-alpha.36",
-	"@geekmidas/cache": "~10.0.0-alpha.36",
-	"@geekmidas/client": "~10.0.0-alpha.36",
-	"@geekmidas/cloud": "~10.0.0-alpha.36",
-	"@geekmidas/constructs": "~10.0.0-alpha.36",
-	"@geekmidas/db": "~10.0.0-alpha.36",
-	"@geekmidas/emailkit": "~10.0.0-alpha.36",
-	"@geekmidas/envkit": "~10.0.0-alpha.36",
-	"@geekmidas/errors": "~10.0.0-alpha.36",
-	"@geekmidas/events": "~10.0.0-alpha.36",
-	"@geekmidas/logger": "~10.0.0-alpha.36",
-	"@geekmidas/manifest": "~10.0.0-alpha.36",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.36",
-	"@geekmidas/schema": "~10.0.0-alpha.36",
-	"@geekmidas/services": "~10.0.0-alpha.36",
-	"@geekmidas/storage": "~10.0.0-alpha.36",
-	"@geekmidas/studio": "~10.0.0-alpha.36",
-	"@geekmidas/telescope": "~10.0.0-alpha.36",
-	"@geekmidas/testkit": "~10.0.0-alpha.36",
+	"@geekmidas/audit": "~10.0.0-alpha.38",
+	"@geekmidas/auth": "~10.0.0-alpha.38",
+	"@geekmidas/cache": "~10.0.0-alpha.38",
+	"@geekmidas/client": "~10.0.0-alpha.38",
+	"@geekmidas/cloud": "~10.0.0-alpha.38",
+	"@geekmidas/constructs": "~10.0.0-alpha.38",
+	"@geekmidas/db": "~10.0.0-alpha.38",
+	"@geekmidas/emailkit": "~10.0.0-alpha.38",
+	"@geekmidas/envkit": "~10.0.0-alpha.38",
+	"@geekmidas/errors": "~10.0.0-alpha.38",
+	"@geekmidas/events": "~10.0.0-alpha.38",
+	"@geekmidas/logger": "~10.0.0-alpha.38",
+	"@geekmidas/manifest": "~10.0.0-alpha.38",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.38",
+	"@geekmidas/schema": "~10.0.0-alpha.38",
+	"@geekmidas/services": "~10.0.0-alpha.38",
+	"@geekmidas/storage": "~10.0.0-alpha.38",
+	"@geekmidas/studio": "~10.0.0-alpha.38",
+	"@geekmidas/telescope": "~10.0.0-alpha.38",
+	"@geekmidas/testkit": "~10.0.0-alpha.38",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -9400,16 +10146,7 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
-	const stageSecrets = sst ? `${credentials}
-      # The stage's secrets, from SSM in the account the role belongs to —
-      # pushed there once with \`gkm secrets:push --stage <stage> --profile …\`.
-      # The stage reaches the shell as a variable, never pasted into the script:
-      # on a manual run it is whatever was typed.
-      - name: Stage secrets
-        run: ${pm.exec} gkm secrets:pull --stage "$STAGE"
-        env:
-          STAGE: \${{ matrix.stage }}
-` : `
+	const stageSecrets = sst ? credentials : `
       # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
       # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
       # gitignored, so a checkout has the key but not the file: set
@@ -10835,7 +11572,7 @@ function secretsStore(options) {
 	if (options.deployTarget !== "sst" || !options.region) return "";
 	return `
     // Deployed stages keep their secrets in SSM, in the account each stage
-    // deploys to: \`gkm secrets:push --stage <stage> --profile <profile>\`.
+    // deploys to: \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
     store: { provider: 'ssm', region: '${options.region}' },`;
 }
 /**
@@ -14729,7 +15466,7 @@ async function initCommand(projectName, options = {}) {
 	}
 	console.log("🔐 Initializing encrypted secrets...\n");
 	const local = templateOptions.stages.local;
-	const devSecrets = require_reconcile.createStageSecrets(local, [], { projectName: name });
+	const devSecrets = createStageSecrets(local, [], { projectName: name });
 	const customSecrets = {
 		PORT: "3000",
 		LOG_LEVEL: "debug",
@@ -14743,8 +15480,8 @@ async function initCommand(projectName, options = {}) {
 		customSecrets.BETTER_AUTH_TRUSTED_ORIGINS = "http://localhost:3000,http://localhost:3001";
 	}
 	devSecrets.custom = customSecrets;
-	await require_storage.writeStageSecrets(devSecrets, targetDir);
-	const keyPath = require_storage.getKeyPath(local, name);
+	await new require_store.FileSecretsStore(targetDir).write(local, devSecrets);
+	const keyPath = require_store.getKeyPath(local, name);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -14896,15 +15633,104 @@ var NotAnAwsRegion = class extends Error {
 	}
 };
 //#endregion
+//#region src/setup/fullstack-secrets.ts
+/**
+* Generate a secure random password for database users.
+* Uses a combination of timestamp and random bytes for uniqueness.
+*/
+function generateDbPassword() {
+	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+}
+/**
+* Generate database URL for an app.
+* All apps connect to the same database, but use different users/schemas.
+*/
+function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
+	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
+}
+/**
+* Generate fullstack-aware custom secrets for a workspace.
+*
+* Generates:
+* - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
+*   decides that; see `gkm init`)
+* - Per-app database passwords and URLs for backend apps with db service
+* - Better-auth secrets for apps using the better-auth framework
+*/
+function generateFullstackCustomSecrets(workspace, containers = []) {
+	const hasDb = containers.includes("postgres");
+	const customs = {
+		PORT: "3000",
+		LOG_LEVEL: "debug",
+		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
+	};
+	if (!hasDb) return customs;
+	const frontendPorts = [];
+	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
+		if (appConfig.type === "web") {
+			frontendPorts.push(appConfig.port);
+			const upperName = appName.toUpperCase();
+			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
+			continue;
+		}
+		if (appConfig.type === "mobile") continue;
+		const password = generateDbPassword();
+		const upperName = appName.toUpperCase();
+		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
+		customs[`${upperName}_DB_PASSWORD`] = password;
+		if (appConfig.framework === "better-auth") {
+			customs.AUTH_PORT = String(appConfig.port);
+			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
+			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;
+			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
+		}
+	}
+	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
+	return customs;
+}
+/**
+* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
+*
+* The docker/.env file contains database passwords that the PostgreSQL
+* init script reads to create per-app database users.
+*/
+async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
+	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
+	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
+	if (dbPasswordEntries.length === 0) return;
+	const envContent = `# Auto-generated docker environment file
+# Contains database passwords for docker-compose postgres init
+# This file is gitignored - do not commit to version control
+${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
+`;
+	const envPath = (0, node_path.join)(workspaceRoot, "docker", ".env");
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(envPath), { recursive: true });
+	await (0, node_fs_promises.writeFile)(envPath, envContent);
+}
+//#endregion
 //#region src/secrets/index.ts
 const logger$2 = console;
 /**
+* The store the stage named on the command line keeps its secrets in — SSM in
+* its account, for a deployed stage kept there. Outside any workspace nothing
+* names a store, so it is the file.
+*/
+async function storeFor(stage) {
+	try {
+		return await require_store.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
+	} catch (error) {
+		if (error instanceof require_config.ConfigNotFound) return new require_store.FileSecretsStore(process.cwd());
+		throw error;
+	}
+}
+/**
 * Initialize secrets for a stage.
 * Generates secure random passwords for configured services.
 */
 async function secretsInitCommand(options) {
 	const { stage, force } = options;
-	if (!force && require_storage.secretsExist(stage)) {
+	const store = await storeFor(stage);
+	if (!force && await store.read(stage)) {
 		logger$2.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
 		process.exit(1);
 	}
@@ -14914,15 +15740,15 @@ async function secretsInitCommand(options) {
 		const loaded = await require_config.loadWorkspaceConfig();
 		projectName = loaded.workspace.name;
 		if (Object.keys(loaded.workspace.apps).length > 1) {
-			workspaceSecrets = require_reconcile.generateFullstackCustomSecrets(loaded.workspace);
+			workspaceSecrets = generateFullstackCustomSecrets(loaded.workspace);
 			logger$2.log("  Detected workspace mode — generating per-app secrets");
 		}
 	} catch {}
-	const secrets = require_reconcile.createStageSecrets(stage, [], { projectName });
+	const secrets = createStageSecrets(stage, [], { projectName });
 	if (workspaceSecrets) secrets.custom = workspaceSecrets;
-	await require_storage.writeStageSecrets(secrets);
+	await store.write(stage, secrets);
 	logger$2.log(`\n✓ Secrets initialized for stage "${stage}"`);
-	logger$2.log(`  Location: .gkm/secrets/${stage}.json`);
+	logger$2.log(`  Store: ${store.name}`);
 	if (secrets.urls.DATABASE_URL) logger$2.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
 	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
@@ -14957,20 +15783,21 @@ async function secretsSetCommand(key, value, options) {
 			process.exit(1);
 		}
 	}
-	try {
-		await require_storage.setCustomSecret(stage, key, secretValue);
-		logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
-	} catch (error) {
-		logger$2.error(error instanceof Error ? error.message : "Failed to set secret");
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
+	if (!secrets) {
+		logger$2.error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
+	await store.write(stage, require_storage.withCustomSecret(secrets, key, secretValue));
+	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /**
 * Show secrets for a stage.
 */
 async function secretsShowCommand(options) {
 	const { stage, reveal } = options;
-	const secrets = await require_storage.readStageSecrets(stage);
+	const secrets = await (await storeFor(stage)).read(stage);
 	if (!secrets) {
 		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
@@ -15003,7 +15830,8 @@ async function secretsShowCommand(options) {
 */
 async function secretsRotateCommand(options) {
 	const { stage, service } = options;
-	const secrets = await require_storage.readStageSecrets(stage);
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
 	if (!secrets) {
 		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
@@ -15013,14 +15841,14 @@ async function secretsRotateCommand(options) {
 			logger$2.error(`Service "${service}" not configured in stage "${stage}"`);
 			process.exit(1);
 		}
-		const updated = require_reconcile.rotateServicePassword(secrets, service);
-		await require_storage.writeStageSecrets(updated);
+		const updated = rotateServicePassword(secrets, service);
+		await store.write(stage, updated);
 		logger$2.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
 	} else {
 		let updated = secrets;
 		const services = Object.keys(secrets.services);
-		for (const svc of services) updated = require_reconcile.rotateServicePassword(updated, svc);
-		await require_storage.writeStageSecrets(updated);
+		for (const svc of services) updated = rotateServicePassword(updated, svc);
+		await store.write(stage, updated);
 		logger$2.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
 	}
 	logger$2.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
@@ -15044,7 +15872,8 @@ async function secretsImportCommand(file, options) {
 		logger$2.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
 		process.exit(1);
 	}
-	const secrets = await require_storage.readStageSecrets(stage);
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
 	if (!secrets) {
 		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
@@ -15058,7 +15887,7 @@ async function secretsImportCommand(file, options) {
 		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		custom: updatedCustom
 	};
-	await require_storage.writeStageSecrets(updated);
+	await store.write(stage, updated);
 	const importedCount = Object.keys(importedSecrets).length;
 	const totalCount = Object.keys(updatedCustom).length;
 	logger$2.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
@@ -15079,121 +15908,6 @@ function maskUrl(url) {
 	}
 }
 //#endregion
-//#region src/secrets/store.ts
-/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */
-var FileSecretsStore = class {
-	root;
-	constructor(root) {
-		this.root = root;
-	}
-	pull(stage) {
-		return require_storage.readStageSecrets(stage, this.root);
-	}
-	push(_stage, secrets) {
-		return require_storage.writeStageSecrets(secrets, this.root);
-	}
-};
-/**
-* The store a stage's secrets live in.
-*
-* The local stage is always the file: its secrets belong to the machine
-* running `gkm dev`. A deployed stage uses `secrets.store`.
-*/
-async function secretsStoreFor(workspace, stage, options = {}) {
-	const configured = workspace.secrets.store ?? "file";
-	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root);
-	if (configured.provider !== "ssm") return configured.provider;
-	const { SsmSecretsStore } = await Promise.resolve().then(() => require("./ssm-FxeSAt35.cjs"));
-	return new SsmSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
-}
-/** Whether a stage's secrets live somewhere other than this machine. */
-function isRemoteStore(workspace, stage) {
-	const configured = workspace.secrets.store ?? "file";
-	return stage !== workspace.stages.local && configured !== "file";
-}
-//#endregion
-//#region src/secrets/transfer.ts
-/**
-* Moving a deployed stage's secrets between this machine and its store.
-*
-* `push` sends the encrypted local copy to the stage's store; `pull` brings it
-* back and writes the local copy a deploy reads — generating a key for it if
-* the machine has none, which is what a fresh CI runner needs. Both reconcile
-* the keys the workspace now derives, so a store never lags a new construct.
-*/
-var transfer_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	NoLocalSecrets: () => NoLocalSecrets,
-	NoRemoteSecretsStore: () => NoRemoteSecretsStore,
-	NoStoredSecrets: () => NoStoredSecrets,
-	pullStageSecrets: () => pullStageSecrets,
-	pushStageSecrets: () => pushStageSecrets
-});
-/** A push or pull for a stage with nowhere to push or pull from. */
-var NoRemoteSecretsStore = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`Stage "${stage}" keeps its secrets in the local file, so there is nothing to push or pull. Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.`);
-		this.stage = stage;
-		this.name = "NoRemoteSecretsStore";
-	}
-};
-/** A push for a stage whose secrets this machine does not have. */
-var NoLocalSecrets = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`No secrets for stage "${stage}" on this machine. Run gkm secrets:init --stage ${stage} first.`);
-		this.stage = stage;
-		this.name = "NoLocalSecrets";
-	}
-};
-/** A pull for a stage the store holds nothing for. */
-var NoStoredSecrets = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The store holds no secrets for stage "${stage}". Push them first: gkm secrets:push --stage ${stage}.`);
-		this.stage = stage;
-		this.name = "NoStoredSecrets";
-	}
-};
-async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-C0X8xSXV.cjs")).then((n) => n.workspace_exports);
-	const result = require_reconcile.reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
-	return result ? {
-		secrets: result.secrets,
-		addedKeys: result.addedKeys
-	} : {
-		secrets,
-		addedKeys: []
-	};
-}
-function remoteOnly(workspace, stage) {
-	require_workspace.assertDeployedStage(workspace.stages, stage);
-	if (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);
-}
-/** Send this machine's secrets for a deployed stage to its store. */
-async function pushStageSecrets(workspace, stage, options = {}) {
-	remoteOnly(workspace, stage);
-	const local = await require_storage.readStageSecrets(stage, workspace.root);
-	if (!local) throw new NoLocalSecrets(stage);
-	const result = await reconcile(local, workspace, stage);
-	if (result.addedKeys.length) await require_storage.writeStageSecrets(result.secrets, workspace.root);
-	await (await secretsStoreFor(workspace, stage, options)).push(stage, result.secrets);
-	return result;
-}
-/** Bring a deployed stage's secrets from its store into the local copy. */
-async function pullStageSecrets(workspace, stage, options = {}) {
-	remoteOnly(workspace, stage);
-	const stored = await (await secretsStoreFor(workspace, stage, options)).pull(stage);
-	if (!stored) throw new NoStoredSecrets(stage);
-	const result = await reconcile(stored, workspace, stage);
-	await require_storage.writeStageSecrets(result.secrets, workspace.root);
-	return result;
-}
-//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
@@ -15233,7 +15947,7 @@ async function setupCommand(options = {}) {
 	}
 	const containers = await require_workspace$1.derivedContainers(workspace, stage);
 	if (isMultiApp && containers.includes("postgres")) {
-		await require_reconcile.writeDockerEnvFromSecrets(secrets, workspace.root);
+		await writeDockerEnvFromSecrets(secrets, workspace.root);
 		logger$1.log("📄 Generated docker/.env with database passwords");
 	}
 	if (!options.skipDocker) {
@@ -15275,30 +15989,18 @@ async function reconcileLocal(workspace, stage, options) {
 async function resolveSecrets(stage, workspace, options) {
 	if (options.force) {
 		logger$1.log("🔐 Generating fresh secrets (--force)...");
-		return generateFreshSecrets(stage, workspace, options);
-	}
-	if (require_storage.secretsExist(stage, workspace.root)) {
-		logger$1.log("🔐 Using existing local secrets");
-		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			const reconciled = reconcileSecrets(secrets, workspace, await require_workspace$1.derivedContainers(workspace, stage));
-			if (reconciled) await require_storage.writeStageSecrets(reconciled, workspace.root);
-			return reconciled ?? secrets;
-		}
+		return generateFreshSecrets(stage, workspace);
 	}
-	if (isRemoteStore(workspace, stage)) {
-		logger$1.log("☁️  Checking the secrets store...");
-		try {
-			const { secrets } = await pullStageSecrets(workspace, stage);
-			logger$1.log("✅ Pulled secrets from the store");
-			return secrets;
-		} catch (error) {
-			if (error instanceof NoStoredSecrets) logger$1.log("   The store holds none yet");
-			else logger$1.warn(`⚠️  Could not pull from the store: ${error.message}`);
-		}
+	const store = await require_store.secretsStoreFor(workspace, stage);
+	const secrets = await store.read(stage);
+	if (secrets) {
+		logger$1.log("🔐 Using existing secrets");
+		const reconciled = reconcileSecrets(secrets, workspace, await require_workspace$1.derivedContainers(workspace, stage));
+		if (reconciled) await store.write(stage, reconciled);
+		return reconciled ?? secrets;
 	}
 	logger$1.log("🔐 Generating fresh development secrets...");
-	return generateFreshSecrets(stage, workspace, options);
+	return generateFreshSecrets(stage, workspace);
 }
 /**
 * Reconcile existing secrets with expected workspace-derived keys.
@@ -15328,7 +16030,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 	let changed = false;
 	let result = { ...secrets };
 	for (const name of credentialedServices(containers)) if (!result.services[name]) {
-		const creds = require_reconcile.generateServiceCredentials(name);
+		const creds = generateServiceCredentials(name);
 		if (name === "minio") {
 			creds.bucket = workspace.name;
 			creds.username = workspace.name;
@@ -15340,7 +16042,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 				[name]: creds
 			}
 		};
-		result.urls = require_reconcile.generateConnectionUrls(result.services);
+		result.urls = generateConnectionUrls(result.services);
 		logger$1.log(`   🔄 Adding missing service credentials: ${name}`);
 		changed = true;
 	}
@@ -15353,17 +16055,17 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 					host: result.services.postgres.host,
 					port: result.services.postgres.port,
 					username: "pgboss",
-					password: require_reconcile.generateSecurePassword(),
+					password: generateSecurePassword(),
 					database: result.services.postgres.database ?? "app"
 				}
 			}
 		};
-		result.urls = require_reconcile.generateConnectionUrls(result.services);
+		result.urls = generateConnectionUrls(result.services);
 		logger$1.log("   🔄 Adding missing service credentials: pgboss");
 		changed = true;
 	}
 	if (Object.keys(workspace.apps).length > 1) {
-		const expected = require_reconcile.generateFullstackCustomSecrets(workspace, containers);
+		const expected = generateFullstackCustomSecrets(workspace, containers);
 		const missing = {};
 		for (const [key, value] of Object.entries(expected)) if (!(key in result.custom)) missing[key] = value;
 		if (Object.keys(missing).length > 0) {
@@ -15392,9 +16094,8 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 * @internal Exported for reuse by `gkm test` auto-setup.
 */
 function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
-	const serviceNames = credentialedServices(containers);
-	const secrets = require_reconcile.createStageSecrets(stage, serviceNames, { projectName: workspace.name });
-	if (Object.keys(workspace.apps).length > 1) secrets.custom = require_reconcile.generateFullstackCustomSecrets(workspace, containers);
+	const secrets = createStageSecrets(stage, credentialedServices(containers), { projectName: workspace.name });
+	if (Object.keys(workspace.apps).length > 1) secrets.custom = generateFullstackCustomSecrets(workspace, containers);
 	else secrets.custom = {
 		PORT: "3000",
 		LOG_LEVEL: "debug",
@@ -15408,38 +16109,26 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 *
 * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a
 * committed secrets file or a shared encryption key — the stage is regenerated
-* from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.
+* from the committed `gkm.config.ts`, and the file store mints a local key.
 *
 * @returns true if fresh secrets were generated, false if existing ones were kept
 */
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
-	if (require_storage.secretsExist(stage, workspace.root)) return false;
+	const store = await require_store.secretsStoreFor(workspace, stage);
+	if (await store.read(stage)) return false;
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_workspace$1.derivedContainers(workspace, stage));
-	await require_storage.writeStageSecrets(secrets, workspace.root);
+	await store.write(stage, secrets);
 	return true;
 }
 /**
 * Generate fresh secrets for the workspace.
 */
-async function generateFreshSecrets(stage, workspace, options) {
+async function generateFreshSecrets(stage, workspace) {
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_workspace$1.derivedContainers(workspace, stage));
-	await require_storage.writeStageSecrets(secrets, workspace.root);
-	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (isRemoteStore(workspace, stage) && !options.yes) {
-		const { shouldPush } = await (0, prompts.default)({
-			type: "confirm",
-			name: "shouldPush",
-			message: `Push the "${stage}" secrets to its store?`,
-			initial: true
-		});
-		if (shouldPush) try {
-			await pushStageSecrets(workspace, stage);
-			logger$1.log("☁️  Secrets pushed to the store");
-		} catch (error) {
-			logger$1.warn(`⚠️  Could not push to the store: ${error.message}`);
-		}
-	}
+	const store = await require_store.secretsStoreFor(workspace, stage);
+	await store.write(stage, secrets);
+	logger$1.log(`   Secrets written to the "${stage}" store (${store.name})`);
 	return secrets;
 }
 /**
@@ -15459,6 +16148,56 @@ function printSummary(workspace, stage) {
 	logger$1.log("");
 }
 //#endregion
+//#region src/test/teardown.ts
+/**
+* Dropping the test stage's databases when a suite ends.
+*
+* Reconcile never drops — the line it draws is at data. The test stage's data
+* is the exception: every test runs in a transaction rolled back after it, so
+* nothing in these databases is anyone's, and a database kept between runs is
+* one whose migrations already ran — an edited migration is never applied to
+* it again. So each run starts from a database it created, and drops it when
+* the suite ends: the Vitest global setup's teardown.
+*/
+/**
+* Drop the databases the last setup recorded, and forget the test stage's
+* reconcile, so the next run provisions them from nothing.
+*
+* A no-op when nothing is recorded — no run yet, or one already torn down —
+* so running it twice, or before a setup, is harmless.
+*/
+async function dropTestDatabases(cwd, root, sql = require_workspace$1.pgClient) {
+	const readyPath = (0, node_path.join)(cwd, require_ready.TEST_READY_FILE);
+	const ready = await readReady(readyPath);
+	const recorded = ready?.databases;
+	if (!ready || !recorded) return [];
+	const client = sql(recorded.port);
+	for (const name of recorded.names) {
+		if (!name.endsWith(`_test`)) throw new NotATestDatabase(name);
+		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_workspace$1.quoteIdentifier(name)} WITH (FORCE)`);
+	}
+	await require_workspace$1.forgetState(root, require_workspace.TEST_STAGE);
+	const { databases: _dropped, ...rest } = ready;
+	await (0, node_fs_promises.writeFile)(readyPath, JSON.stringify(rest, null, 2));
+	return recorded.names;
+}
+async function readReady(path) {
+	try {
+		return JSON.parse(await (0, node_fs_promises.readFile)(path, "utf-8"));
+	} catch {
+		return;
+	}
+}
+/** A name recorded for the test stage without the test stage's suffix. */
+var NotATestDatabase = class extends Error {
+	database;
+	constructor(database) {
+		super(`Refusing to drop '${database}': only the test stage's databases (named '…_${require_workspace.TEST_STAGE}') are dropped after a suite. Delete ${require_ready.TEST_READY_FILE} if it was edited by hand.`);
+		this.database = database;
+		this.name = "NotATestDatabase";
+	}
+};
+//#endregion
 //#region src/test/index.ts
 /**
 * Run tests with secrets, dependency URLs, and .env files loaded.
@@ -15467,6 +16206,10 @@ function printSummary(workspace, stage) {
 async function testCommand(options = {}) {
 	const cwd = process.cwd();
 	const stage = options.stage ?? await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
+	if (options.teardown) {
+		await teardown(cwd);
+		return;
+	}
 	if (!stage) throw new NoStageToTest();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	if (options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP)) {
@@ -15475,6 +16218,7 @@ async function testCommand(options = {}) {
 	}
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (!options.prepare) await teardown(cwd);
 	const result = await require_workspace$1.prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
@@ -15515,7 +16259,8 @@ async function testCommand(options = {}) {
 	const readyPath = (0, node_path.join)(cwd, require_ready.TEST_READY_FILE);
 	await (0, node_fs_promises.writeFile)(readyPath, JSON.stringify({
 		env: result.secretsJsonPath,
-		...manifestPath ? { manifest: manifestPath } : {}
+		...manifestPath ? { manifest: manifestPath } : {},
+		...testDatabases(result.reconciled)
 	}, null, 2));
 	if (options.setup) {
 		console.log(`  🧪 Test stage ready: ${require_ready.TEST_READY_FILE}`);
@@ -15554,12 +16299,29 @@ async function testCommand(options = {}) {
 		});
 	});
 }
+/** Drop what the last setup created — see `dropTestDatabases`. */
+async function teardown(cwd) {
+	const dropped = await dropTestDatabases(cwd, await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.root).catch(() => cwd));
+	if (dropped.length > 0) console.log(`  🧹 Dropped ${dropped.join(", ")}`);
+}
+/**
+* The test stage's Postgres databases, to drop when the suite ends — those
+* the plan provisions, on the port the shared container answers.
+*/
+function testDatabases(reconciled) {
+	const port = reconciled?.ports[require_workspace$1.primaryPortKey("postgres")];
+	const names = (reconciled?.plan.resources ?? []).filter((resource) => resource.kind === "database" && resource.provisions && resource.container === "postgres").map((resource) => resource.name);
+	return port !== void 0 && names.length > 0 ? { databases: {
+		port,
+		names
+	} } : {};
+}
 /**
 * Migrate the test stage just reconciled, then seed it: a test run never
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BsW4xBEO.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DKn83skp.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-CroTIm0K.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -15959,7 +16721,7 @@ program.command("build").description("Build handlers and the manifest from decla
 		process.exit(1);
 	}
 });
-program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").action(async (options) => {
+program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").option("--fake", "Call each external API’s fake (test/fakes/<id>.ts) instead of the provider").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15970,7 +16732,8 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 			entry: options.entry,
 			watch: options.watch,
 			migrate: options.migrate,
-			seed: options.seed
+			seed: options.seed,
+			fake: options.fake
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -15987,7 +16750,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").option("--teardown", "Drop the test stage's databases the last setup created, then stop — what @geekmidas/cli/vitest runs when the suite ends").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16004,7 +16767,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BsW4xBEO.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DKn83skp.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16018,7 +16781,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BsW4xBEO.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DKn83skp.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16032,7 +16795,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BsW4xBEO.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DKn83skp.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16156,57 +16919,28 @@ program.command("secrets:import").description("Import secrets from a JSON file")
 		process.exit(1);
 	}
 });
-program.command("secrets:push").description("Send a deployed stage's secrets to its store (secrets.store)").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
-	try {
-		const globalOptions = program.opts();
-		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushStageSecrets } = await Promise.resolve().then(() => transfer_exports);
-		const { workspace } = await loadWorkspaceConfig();
-		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
-		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
-		console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
-	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
-	}
-});
-program.command("secrets:pull").description("Bring a deployed stage's secrets from its store into the local copy").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
-	try {
-		const globalOptions = program.opts();
-		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullStageSecrets } = await Promise.resolve().then(() => transfer_exports);
-		const { workspace } = await loadWorkspaceConfig();
-		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
-		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
-		console.log(`\n✓ Secrets pulled for stage "${options.stage}"`);
-	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
-	}
-});
 program.command("secrets:reconcile").description("Backfill missing custom secrets from workspace config").option("--stage <stage>", "Stage name (default: stages.local)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-BxZTV2vl.cjs")).then((n) => n.reconcile_exports);
-		const { readStageSecrets, writeStageSecrets } = await Promise.resolve().then(() => require("./storage-C2JC31V9.cjs")).then((n) => n.storage_exports);
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./store-DQgxT_WR.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
-		const secrets = await readStageSecrets(stage, workspace.root);
+		const store = await secretsStoreFor(workspace, stage);
+		const secrets = await store.read(stage);
 		if (!secrets) {
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-C0X8xSXV.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-gfIrSEUp.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
 			return;
 		}
-		await writeStageSecrets(result.secrets, workspace.root);
+		await store.write(stage, result.secrets);
 		console.log(`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${stage}":`);
 		for (const key of result.addedKeys) console.log(`    + ${key}`);
 	} catch (error) {
@@ -16259,7 +16993,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-tZmMZ7td.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BvK076ph.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16390,9 +17124,8 @@ Object.defineProperty(exports, "encryption_exports", {
 		return encryption_exports;
 	}
 });
+exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.getHostingerToken = getHostingerToken;
-exports.isRemoteStore = isRemoteStore;
-exports.pushStageSecrets = pushStageSecrets;
 exports.slug = slug;
 exports.stamp = stamp;