@geekmidas/cli 10.0.0-alpha.36 → 10.0.0-alpha.38

package/dist/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { c as isPartitionedRoutes, i as ConstructGenerator, t as discover } from "./discover-CMxesskG.mjs";
-import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-Dss1WwtH.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-CsL76tpc.mjs";
-import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-BjTLjDDp.mjs";
-import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-EmXwO2qM.mjs";
+import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-D1S2r0JN.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-DOmIhiau.mjs";
+import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
+import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
+import { C as findAvailablePort, D as prepareEntryCredentials, E as loadSecretsForApp, S as createEntryWrapper, T as loadEnvFiles, _ as cacheBackendFor, a as reconcileWorkspace, b as storageBackendFor, c as LOCAL_CA_PATH, d as quoteIdentifier, f as pgClient, g as primaryPortKey, h as fakeKey, i as derivedContainers, l as forgetState, m as rootSite, n as backendsOf, p as resourceName, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as eventsBackendFor, w as isPortAvailable, x as createCredentialsPreload, y as providerOf } from "./workspace-Lm6dv2nz.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-hDINScnz.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-D1BCiaYU.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-BTm_sMNU.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
-import { a as createStageSecrets, c as generateServiceCredentials, i as writeDockerEnvFromSecrets, l as rotateServicePassword, o as generateConnectionUrls, r as generateFullstackCustomSecrets, s as generateSecurePassword, t as reconcileMissingSecrets } from "./reconcile-yNq6Shau.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -19,7 +19,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
 import { execFile, execSync, spawn } from "node:child_process";
-import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, migrationFolder, mobileOrigins, provideKey, provisionOrder, schemeBase, scopedName, serviceKey } from "@geekmidas/manifest";
+import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, externalApiUrl, kebabCase, migrationFolder, mobileOrigins, provideKey, provisionOrder, schemeBase, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import chokidar from "chokidar";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
@@ -30,6 +30,10 @@ import { parse as parse$1, parseDocument } from "yaml";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import prompts from "prompts";
+import { createServer } from "http";
+import { Http2ServerRequest } from "http2";
+import { Readable } from "stream";
+import crypto from "crypto";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
@@ -37,7 +41,7 @@ import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.36";
+var version = "10.0.0-alpha.38";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -578,6 +582,485 @@ var UnsupportedPlatform = class extends Error {
 	}
 };
 //#endregion
+//#region ../../node_modules/.pnpm/@hono+node-server@1.19.5_hono@4.13.8/node_modules/@hono/node-server/dist/index.mjs
+var RequestError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "RequestError";
+	}
+};
+var toRequestError = (e) => {
+	if (e instanceof RequestError) return e;
+	return new RequestError(e.message, { cause: e });
+};
+var GlobalRequest = global.Request;
+var Request = class extends GlobalRequest {
+	constructor(input, options) {
+		if (typeof input === "object" && getRequestCache in input) input = input[getRequestCache]();
+		if (typeof options?.body?.getReader !== "undefined") options.duplex ??= "half";
+		super(input, options);
+	}
+};
+var newHeadersFromIncoming = (incoming) => {
+	const headerRecord = [];
+	const rawHeaders = incoming.rawHeaders;
+	for (let i = 0; i < rawHeaders.length; i += 2) {
+		const { [i]: key, [i + 1]: value } = rawHeaders;
+		if (key.charCodeAt(0) !== 58) headerRecord.push([key, value]);
+	}
+	return new Headers(headerRecord);
+};
+var wrapBodyStream = Symbol("wrapBodyStream");
+var newRequestFromIncoming = (method, url, headers, incoming, abortController) => {
+	const init = {
+		method,
+		headers,
+		signal: abortController.signal
+	};
+	if (method === "TRACE") {
+		init.method = "GET";
+		const req = new Request(url, init);
+		Object.defineProperty(req, "method", { get() {
+			return "TRACE";
+		} });
+		return req;
+	}
+	if (!(method === "GET" || method === "HEAD")) {
+		if ("rawBody" in incoming && incoming.rawBody instanceof Buffer) init.body = new ReadableStream({ start(controller) {
+			controller.enqueue(incoming.rawBody);
+			controller.close();
+		} });
+		else if (incoming[wrapBodyStream]) {
+			let reader;
+			init.body = new ReadableStream({ async pull(controller) {
+				try {
+					reader ||= Readable.toWeb(incoming).getReader();
+					const { done, value } = await reader.read();
+					if (done) controller.close();
+					else controller.enqueue(value);
+				} catch (error) {
+					controller.error(error);
+				}
+			} });
+		} else init.body = Readable.toWeb(incoming);
+	}
+	return new Request(url, init);
+};
+var getRequestCache = Symbol("getRequestCache");
+var requestCache = Symbol("requestCache");
+var incomingKey = Symbol("incomingKey");
+var urlKey = Symbol("urlKey");
+var headersKey = Symbol("headersKey");
+var abortControllerKey = Symbol("abortControllerKey");
+var requestPrototype = {
+	get method() {
+		return this[incomingKey].method || "GET";
+	},
+	get url() {
+		return this[urlKey];
+	},
+	get headers() {
+		return this[headersKey] ||= newHeadersFromIncoming(this[incomingKey]);
+	},
+	[Symbol("getAbortController")]() {
+		this[getRequestCache]();
+		return this[abortControllerKey];
+	},
+	[getRequestCache]() {
+		this[abortControllerKey] ||= new AbortController();
+		return this[requestCache] ||= newRequestFromIncoming(this.method, this[urlKey], this.headers, this[incomingKey], this[abortControllerKey]);
+	}
+};
+[
+	"body",
+	"bodyUsed",
+	"cache",
+	"credentials",
+	"destination",
+	"integrity",
+	"mode",
+	"redirect",
+	"referrer",
+	"referrerPolicy",
+	"signal",
+	"keepalive"
+].forEach((k) => {
+	Object.defineProperty(requestPrototype, k, { get() {
+		return this[getRequestCache]()[k];
+	} });
+});
+[
+	"arrayBuffer",
+	"blob",
+	"clone",
+	"formData",
+	"json",
+	"text"
+].forEach((k) => {
+	Object.defineProperty(requestPrototype, k, { value: function() {
+		return this[getRequestCache]()[k]();
+	} });
+});
+Object.setPrototypeOf(requestPrototype, Request.prototype);
+var newRequest = (incoming, defaultHostname) => {
+	const req = Object.create(requestPrototype);
+	req[incomingKey] = incoming;
+	const incomingUrl = incoming.url || "";
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		if (incoming instanceof Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
+		try {
+			req[urlKey] = new URL(incomingUrl).href;
+		} catch (e) {
+			throw new RequestError("Invalid absolute URL", { cause: e });
+		}
+		return req;
+	}
+	const host = (incoming instanceof Http2ServerRequest ? incoming.authority : incoming.headers.host) || defaultHostname;
+	if (!host) throw new RequestError("Missing host header");
+	let scheme;
+	if (incoming instanceof Http2ServerRequest) {
+		scheme = incoming.scheme;
+		if (!(scheme === "http" || scheme === "https")) throw new RequestError("Unsupported scheme");
+	} else scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
+	const url = new URL(`${scheme}://${host}${incomingUrl}`);
+	if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) throw new RequestError("Invalid host header");
+	req[urlKey] = url.href;
+	return req;
+};
+var responseCache = Symbol("responseCache");
+var getResponseCache = Symbol("getResponseCache");
+var cacheKey = Symbol("cache");
+var GlobalResponse = global.Response;
+var Response2 = class _Response {
+	#body;
+	#init;
+	[getResponseCache]() {
+		delete this[cacheKey];
+		return this[responseCache] ||= new GlobalResponse(this.#body, this.#init);
+	}
+	constructor(body, init) {
+		let headers;
+		this.#body = body;
+		if (init instanceof _Response) {
+			const cachedGlobalResponse = init[responseCache];
+			if (cachedGlobalResponse) {
+				this.#init = cachedGlobalResponse;
+				this[getResponseCache]();
+				return;
+			} else {
+				this.#init = init.#init;
+				headers = new Headers(init.#init.headers);
+			}
+		} else this.#init = init;
+		if (typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) {
+			headers ||= init?.headers || { "content-type": "text/plain; charset=UTF-8" };
+			this[cacheKey] = [
+				init?.status || 200,
+				body,
+				headers
+			];
+		}
+	}
+	get headers() {
+		const cache = this[cacheKey];
+		if (cache) {
+			if (!(cache[2] instanceof Headers)) cache[2] = new Headers(cache[2]);
+			return cache[2];
+		}
+		return this[getResponseCache]().headers;
+	}
+	get status() {
+		return this[cacheKey]?.[0] ?? this[getResponseCache]().status;
+	}
+	get ok() {
+		const status = this.status;
+		return status >= 200 && status < 300;
+	}
+};
+[
+	"body",
+	"bodyUsed",
+	"redirected",
+	"statusText",
+	"trailers",
+	"type",
+	"url"
+].forEach((k) => {
+	Object.defineProperty(Response2.prototype, k, { get() {
+		return this[getResponseCache]()[k];
+	} });
+});
+[
+	"arrayBuffer",
+	"blob",
+	"clone",
+	"formData",
+	"json",
+	"text"
+].forEach((k) => {
+	Object.defineProperty(Response2.prototype, k, { value: function() {
+		return this[getResponseCache]()[k]();
+	} });
+});
+Object.setPrototypeOf(Response2, GlobalResponse);
+Object.setPrototypeOf(Response2.prototype, GlobalResponse.prototype);
+async function readWithoutBlocking(readPromise) {
+	return Promise.race([readPromise, Promise.resolve().then(() => Promise.resolve(void 0))]);
+}
+function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromise) {
+	const cancel = (error) => {
+		reader.cancel(error).catch(() => {});
+	};
+	writable.on("close", cancel);
+	writable.on("error", cancel);
+	(currentReadPromise ?? reader.read()).then(flow, handleStreamError);
+	return reader.closed.finally(() => {
+		writable.off("close", cancel);
+		writable.off("error", cancel);
+	});
+	function handleStreamError(error) {
+		if (error) writable.destroy(error);
+	}
+	function onDrain() {
+		reader.read().then(flow, handleStreamError);
+	}
+	function flow({ done, value }) {
+		try {
+			if (done) writable.end();
+			else if (!writable.write(value)) writable.once("drain", onDrain);
+			else return reader.read().then(flow, handleStreamError);
+		} catch (e) {
+			handleStreamError(e);
+		}
+	}
+}
+function writeFromReadableStream(stream, writable) {
+	if (stream.locked) throw new TypeError("ReadableStream is locked.");
+	else if (writable.destroyed) return;
+	return writeFromReadableStreamDefaultReader(stream.getReader(), writable);
+}
+var buildOutgoingHttpHeaders = (headers) => {
+	const res = {};
+	if (!(headers instanceof Headers)) headers = new Headers(headers ?? void 0);
+	const cookies = [];
+	for (const [k, v] of headers) if (k === "set-cookie") cookies.push(v);
+	else res[k] = v;
+	if (cookies.length > 0) res["set-cookie"] = cookies;
+	res["content-type"] ??= "text/plain; charset=UTF-8";
+	return res;
+};
+var X_ALREADY_SENT = "x-hono-already-sent";
+var webFetch = global.fetch;
+if (typeof global.crypto === "undefined") global.crypto = crypto;
+global.fetch = (info, init) => {
+	init = {
+		compress: false,
+		...init
+	};
+	return webFetch(info, init);
+};
+var outgoingEnded = Symbol("outgoingEnded");
+var handleRequestError = () => new Response(null, { status: 400 });
+var handleFetchError = (e) => new Response(null, { status: e instanceof Error && (e.name === "TimeoutError" || e.constructor.name === "TimeoutError") ? 504 : 500 });
+var handleResponseError = (e, outgoing) => {
+	const err = e instanceof Error ? e : new Error("unknown error", { cause: e });
+	if (err.code === "ERR_STREAM_PREMATURE_CLOSE") console.info("The user aborted a request.");
+	else {
+		console.error(e);
+		if (!outgoing.headersSent) outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		outgoing.end(`Error: ${err.message}`);
+		outgoing.destroy(err);
+	}
+};
+var flushHeaders = (outgoing) => {
+	if ("flushHeaders" in outgoing && outgoing.writable) outgoing.flushHeaders();
+};
+var responseViaCache = async (res, outgoing) => {
+	let [status, body, header] = res[cacheKey];
+	if (header instanceof Headers) header = buildOutgoingHttpHeaders(header);
+	if (typeof body === "string") header["Content-Length"] = Buffer.byteLength(body);
+	else if (body instanceof Uint8Array) header["Content-Length"] = body.byteLength;
+	else if (body instanceof Blob) header["Content-Length"] = body.size;
+	outgoing.writeHead(status, header);
+	if (typeof body === "string" || body instanceof Uint8Array) outgoing.end(body);
+	else if (body instanceof Blob) outgoing.end(new Uint8Array(await body.arrayBuffer()));
+	else {
+		flushHeaders(outgoing);
+		await writeFromReadableStream(body, outgoing)?.catch((e) => handleResponseError(e, outgoing));
+	}
+	outgoing[outgoingEnded]?.();
+};
+var isPromise = (res) => typeof res.then === "function";
+var responseViaResponseObject = async (res, outgoing, options = {}) => {
+	if (isPromise(res)) {
+		if (options.errorHandler) try {
+			res = await res;
+		} catch (err) {
+			const errRes = await options.errorHandler(err);
+			if (!errRes) return;
+			res = errRes;
+		}
+		else res = await res.catch(handleFetchError);
+	}
+	if (cacheKey in res) return responseViaCache(res, outgoing);
+	const resHeaderRecord = buildOutgoingHttpHeaders(res.headers);
+	if (res.body) {
+		const reader = res.body.getReader();
+		const values = [];
+		let done = false;
+		let currentReadPromise = void 0;
+		if (resHeaderRecord["transfer-encoding"] !== "chunked") {
+			let maxReadCount = 2;
+			for (let i = 0; i < maxReadCount; i++) {
+				currentReadPromise ||= reader.read();
+				const chunk = await readWithoutBlocking(currentReadPromise).catch((e) => {
+					console.error(e);
+					done = true;
+				});
+				if (!chunk) {
+					if (i === 1) {
+						await new Promise((resolve) => setTimeout(resolve));
+						maxReadCount = 3;
+						continue;
+					}
+					break;
+				}
+				currentReadPromise = void 0;
+				if (chunk.value) values.push(chunk.value);
+				if (chunk.done) {
+					done = true;
+					break;
+				}
+			}
+			if (done && !("content-length" in resHeaderRecord)) resHeaderRecord["content-length"] = values.reduce((acc, value) => acc + value.length, 0);
+		}
+		outgoing.writeHead(res.status, resHeaderRecord);
+		values.forEach((value) => {
+			outgoing.write(value);
+		});
+		if (done) outgoing.end();
+		else {
+			if (values.length === 0) flushHeaders(outgoing);
+			await writeFromReadableStreamDefaultReader(reader, outgoing, currentReadPromise);
+		}
+	} else if (resHeaderRecord[X_ALREADY_SENT]) {} else {
+		outgoing.writeHead(res.status, resHeaderRecord);
+		outgoing.end();
+	}
+	outgoing[outgoingEnded]?.();
+};
+var getRequestListener = (fetchCallback, options = {}) => {
+	const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
+	if (options.overrideGlobalObjects !== false && global.Request !== Request) {
+		Object.defineProperty(global, "Request", { value: Request });
+		Object.defineProperty(global, "Response", { value: Response2 });
+	}
+	return async (incoming, outgoing) => {
+		let res, req;
+		try {
+			req = newRequest(incoming, options.hostname);
+			let incomingEnded = !autoCleanupIncoming || incoming.method === "GET" || incoming.method === "HEAD";
+			if (!incomingEnded) {
+				incoming[wrapBodyStream] = true;
+				incoming.on("end", () => {
+					incomingEnded = true;
+				});
+				if (incoming instanceof Http2ServerRequest) outgoing[outgoingEnded] = () => {
+					if (!incomingEnded) setTimeout(() => {
+						if (!incomingEnded) setTimeout(() => {
+							incoming.destroy();
+							outgoing.destroy();
+						});
+					});
+				};
+			}
+			outgoing.on("close", () => {
+				if (req[abortControllerKey]) {
+					if (incoming.errored) req[abortControllerKey].abort(incoming.errored.toString());
+					else if (!outgoing.writableFinished) req[abortControllerKey].abort("Client connection prematurely closed.");
+				}
+				if (!incomingEnded) setTimeout(() => {
+					if (!incomingEnded) setTimeout(() => {
+						incoming.destroy();
+					});
+				});
+			});
+			res = fetchCallback(req, {
+				incoming,
+				outgoing
+			});
+			if (cacheKey in res) return responseViaCache(res, outgoing);
+		} catch (e) {
+			if (!res) {
+				if (options.errorHandler) {
+					res = await options.errorHandler(req ? e : toRequestError(e));
+					if (!res) return;
+				} else if (!req) res = handleRequestError();
+				else res = handleFetchError(e);
+			} else return handleResponseError(e, outgoing);
+		}
+		try {
+			return await responseViaResponseObject(res, outgoing, options);
+		} catch (e) {
+			return handleResponseError(e, outgoing);
+		}
+	};
+};
+var createAdaptorServer = (options) => {
+	const fetchCallback = options.fetch;
+	const requestListener = getRequestListener(fetchCallback, {
+		hostname: options.hostname,
+		overrideGlobalObjects: options.overrideGlobalObjects,
+		autoCleanupIncoming: options.autoCleanupIncoming
+	});
+	return (options.createServer || createServer)(options.serverOptions || {}, requestListener);
+};
+var serve = (options, listeningListener) => {
+	const server = createAdaptorServer(options);
+	server.listen(options?.port ?? 3e3, options.hostname, () => {
+		const serverInfo = server.address();
+		listeningListener && listeningListener(serverInfo);
+	});
+	return server;
+};
+//#endregion
+//#region src/dev/fakes.ts
+/**
+* External APIs' app fakes, served for `gkm dev`.
+*
+* An image fake runs with the other containers. An app fake is a fetch handler
+* in `test/fakes/<id>.ts`, and nothing runs it unless this does: each one
+* listens on the port its key was allocated, which is the port the stage's
+* `<ID>_URL` already names.
+*/
+/**
+* Serve every app fake on its allocated port. Image fakes are skipped — their
+* containers are already up.
+*/
+async function serveFakes(fakes, ports) {
+	const served = [];
+	for (const [id, local] of Object.entries(fakes)) {
+		if (local.image) continue;
+		const port = ports[fakeKey(id)];
+		if (port === void 0) continue;
+		const { handler } = (await import(pathToFileURL(local.file).href)).default;
+		const server = serve({
+			fetch: (request) => handler.fetch(request),
+			port
+		});
+		served.push({
+			id,
+			port,
+			server
+		});
+	}
+	return served;
+}
+/** Stop every served fake. */
+function closeFakes(served) {
+	for (const { server } of served) server.close();
+}
+//#endregion
 //#region src/exec/index.ts
 const logger$11 = console;
 /** `gkm exec` was given nothing to run. */
@@ -729,41 +1212,28 @@ async function devCommand(options) {
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const appName = getAppNameFromCwd();
-	let config;
-	let appRoot = process.cwd();
-	let secretsRoot = process.cwd();
-	let workspaceAppName;
-	let workspaceAppPort;
-	let workspace;
-	if (appName) try {
-		const appConfig = await loadAppConfig();
-		config = appConfig.gkmConfig;
-		appRoot = appConfig.appRoot;
-		secretsRoot = appConfig.workspaceRoot;
-		workspaceAppName = appConfig.appName;
-		workspaceAppPort = appConfig.app.port;
-		workspace = appConfig.workspace;
-		if (appConfig.app.entry) {
-			logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
-			return entryDevCommand({
-				...options,
-				entry: appConfig.app.entry,
-				port: workspaceAppPort,
-				portExplicit: true
-			});
-		}
-	} catch {
-		const loadedConfig = await loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") return workspaceDevCommand(loadedConfig.workspace, options);
-		config = loadedConfig.raw;
-		workspace = loadedConfig.workspace;
-	}
-	else {
-		const loadedConfig = await loadWorkspaceConfig();
-		if (loadedConfig.type === "workspace") return workspaceDevCommand(loadedConfig.workspace, options);
-		config = loadedConfig.raw;
-		workspace = loadedConfig.workspace;
+	const appConfig = await loadAppConfig().catch((error) => {
+		if (error instanceof NotInAnApp || error instanceof NotABackendApp) return;
+		throw error;
+	});
+	if (!appConfig) {
+		const { workspace: everything } = await loadWorkspaceConfig();
+		return workspaceDevCommand(everything, options);
+	}
+	const config = appConfig.gkmConfig;
+	const appRoot = appConfig.appRoot;
+	const secretsRoot = appConfig.workspaceRoot;
+	const workspaceAppName = appConfig.appName;
+	const workspaceAppPort = appConfig.app.port;
+	const workspace = appConfig.workspace;
+	if (appConfig.app.entry) {
+		logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
+		return entryDevCommand({
+			...options,
+			entry: appConfig.app.entry,
+			port: workspaceAppPort,
+			portExplicit: true
+		});
 	}
 	if (config.env) {
 		const { loaded, missing } = loadEnvFiles(config.env, appRoot);
@@ -793,9 +1263,12 @@ async function devCommand(options) {
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	let publicUrl;
-	const appSecrets = await loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
+	const appSecrets = await loadSecretsForApp(workspace ? await secretsStoreFor(workspace, config.stages.local) : new FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
 	if (workspace) {
-		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
+		const reconciled = await reconcileWorkspace(workspace, {
+			stage: workspace.stages.local,
+			...options.fake ? { fake: true } : {}
+		});
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
@@ -816,7 +1289,7 @@ async function devCommand(options) {
 	devServer.publicUrl = publicUrl;
 	await devServer.start();
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
-	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
+	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => isAbsolute(p) ? relative(appRoot, p) : p.replace(/^\.\//, ""));
 	const resolvedFiles = await fg(normalizedPatterns, {
 		cwd: appRoot,
 		absolute: false,
@@ -1040,10 +1513,8 @@ async function validateFrontendApps(workspace) {
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
 	const stage = workspace.stages.local;
-	if (secretsExist(stage, workspace.root)) {
-		const secrets = await readStageSecrets(stage, workspace.root);
-		if (secrets) return toEmbeddableSecrets(secrets);
-	}
+	const secrets = await (await secretsStoreFor(workspace, stage)).read(stage);
+	if (secrets) return toEmbeddableSecrets(secrets);
 	return {};
 }
 /**
@@ -1077,7 +1548,10 @@ async function workspaceDevCommand(workspace, options) {
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
+	const reconciled = await reconcileWorkspace(workspace, {
+		stage: workspace.stages.local,
+		...options.fake ? { fake: true } : {}
+	});
 	if (reconciled.changed && reconciled.plan.containers.length > 0) {
 		logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 		for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
@@ -1086,10 +1560,12 @@ async function workspaceDevCommand(workspace, options) {
 		...rawSecrets,
 		...reconciled.env
 	};
+	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
+	for (const { id, port } of fakes) logger$10.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CT8b3nt_.mjs");
+		const { prepareDevDatabases } = await import("./migrate-C2aYSZTn.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CT8b3nt_.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-C2aYSZTn.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1148,7 +1624,8 @@ async function workspaceDevCommand(workspace, options) {
 		...process.env,
 		...secretsEnv,
 		NODE_ENV: "development",
-		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
+		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
+		...options.fake ? { [FAKE_ENV]: "1" } : {}
 	};
 	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(workspace.apps);
 	const held = [];
@@ -1177,6 +1654,7 @@ async function workspaceDevCommand(workspace, options) {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
 		logger$10.log("\n🛑 Shutting down workspace...");
+		closeFakes(fakes);
 		const pid = turboProcess.pid;
 		if (pid) try {
 			process.kill(-pid, "SIGTERM");
@@ -2809,7 +3287,7 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$8.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-D9IPNvDt.mjs");
+			const { bundleServer } = await import("./bundler--fyybf1N.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3293,17 +3771,43 @@ const PROVISIONERS = {
 		return broker(declaration.id, context);
 	},
 	/**
-	* A signing key, generated once and remembered.
+	* A signing key, generated once and remembered in the stage's store.
 	*
-	* Regenerating it on every deploy would invalidate every live session, which
-	* is why the value comes from state when there is one. Nothing is created in
-	* Dokploy: a secret has no address.
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
 	*/
 	secret: async (declaration, context) => {
 		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
 		const key = declaration.provides?.[0];
 		if (!key) return { provides: {} };
-		return { provides: { [key]: context.secrets?.[key] ?? derivedPassword(context, `secret:${declaration.id}`) } };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = provideKey(declaration.id, "credentials");
+		return { provides: {
+			[provideKey(declaration.id, "url")]: externalApiUrl(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
 	},
 	/**
 	* A surface, at the address whatever created its domain assigned.
@@ -3490,14 +3994,16 @@ function soleDatabase(context) {
 	return databases[0];
 }
 /**
-* A password derived from the project, the stage and the role.
+* A password derived from the stage's seed, the project, the stage and the role.
 *
-* Derived rather than random for the reason the local target derives its own: a
-* redeploy must not lock the running application out of its own database, and
-* two projects must not share a credential.
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
 */
 function derivedPassword(context, role) {
-	return createHash("sha256").update(`${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+	return createHash("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
 }
 /** A connection string for a role on a cluster. */
 function postgresUrl(role, password, host, database) {
@@ -3508,6 +4014,29 @@ function quoted(name) {
 	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
 }
 /** A provisioner was handed a declaration of the wrong kind. */
+/**
+* A value only the stage's own secrets can hold.
+*
+* @throws {MissingSuppliedSecret} when the stage was never given it.
+*/
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
+}
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends Error {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
 var WrongKind = class extends Error {
 	kind;
 	constructor(kind) {
@@ -3630,7 +4159,8 @@ async function provisionDeclared(options) {
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
 		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
-		...options.secrets ? { secrets: options.secrets } : {},
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
 		deferred: [],
 		clusters: {}
 	};
@@ -3826,7 +4356,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-GF6NAZAK.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-Bh6K7QYz.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -4654,14 +5184,9 @@ exec "$@"
 */
 function resolveDockerConfig(config) {
 	const docker = config.docker ?? {};
-	let defaultImageName = "api";
-	try {
-		const pkg = __require(`${process.cwd()}/package.json`);
-		if (pkg.name) defaultImageName = pkg.name.replace(/^@[^/]+\//, "");
-	} catch {}
 	return {
 		registry: docker.registry ?? "",
-		imageName: docker.imageName ?? defaultImageName,
+		imageName: docker.imageName ?? config.name ?? "api",
 		baseImage: docker.baseImage ?? "node:22-alpine",
 		port: docker.port ?? 3e3
 	};
@@ -6254,6 +6779,55 @@ function validateEnvVars(requiredVars, context) {
 	};
 }
 //#endregion
+//#region src/deploy/generated.ts
+/**
+* The values a deployed stage generates once and keeps: what nothing can
+* provision and nobody else issues.
+*
+* - **A seed**, which salts every password a deploy derives — a database's
+*   master and roles, a bucket's root user. Derived from repo facts alone
+*   (project, stage, construct id), those passwords were computable by anyone
+*   who could read the repo.
+* - **Each `secret` construct's value** — an auth server's signing secret —
+*   random, rather than derived.
+*
+* Both are generated on the first deploy that needs them and written to the
+* stage's store, so every later deploy reads the same values: sessions survive
+* a redeploy, and a role's password does not move. A value set by hand with
+* `gkm secrets:set` is kept, never replaced.
+*/
+/**
+* The stage's secrets with its seed and every declared `secret`'s value
+* present, generating what is missing. Pure: the caller writes the result
+* back to the stage's store when `generated` is not empty.
+*/
+function withGeneratedSecrets(secrets, manifest) {
+	const generated = [];
+	const custom = { ...secrets.custom };
+	for (const declaration of Object.values(manifest)) {
+		if (declaration?.kind !== "secret") continue;
+		const key = declaration.provides?.[0];
+		if (!key || custom[key]) continue;
+		custom[key] = random();
+		generated.push(key);
+	}
+	const seed = secrets.seed ?? random();
+	if (!secrets.seed) generated.push("seed");
+	return {
+		secrets: generated.length ? {
+			...secrets,
+			seed,
+			custom,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : secrets,
+		generated
+	};
+}
+/** 256 bits, URL-safe. */
+function random() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -7072,10 +7646,13 @@ async function workspaceDeployCommand(configured, options) {
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
 	logger$4.log("\n🔐 Loading secrets and analyzing environment requirements...");
-	const stageSecrets = await readStageSecrets(stage, workspace.root);
-	if (!stageSecrets) {
-		logger$4.log(`   ⚠️  No secrets found for stage "${stage}"`);
-		logger$4.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
+	const secretsStore = await secretsStoreFor(workspace, stage);
+	const stored = await secretsStore.read(stage);
+	if (!stored) logger$4.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
+	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	if (generated.length > 0) {
+		await secretsStore.write(stage, stageSecrets);
+		logger$4.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
 	}
 	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
@@ -7203,6 +7780,8 @@ async function workspaceDeployCommand(configured, options) {
 			environmentId,
 			stage,
 			appUrls,
+			supplied: stageSecrets.custom,
+			seed: stageSecrets.seed,
 			manifest
 		});
 		declaredEnv = declared.env;
@@ -7963,6 +8542,172 @@ function printStateDetails(state) {
 	}
 }
 //#endregion
+//#region src/secrets/generator.ts
+/**
+* Generate a secure random password using URL-safe base64 characters.
+* @param length Password length (default: 32)
+*/
+function generateSecurePassword(length = 32) {
+	return randomBytes(Math.ceil(length * 3 / 4)).toString("base64url").slice(0, length);
+}
+/** Default service configurations (localhost for local dev via Docker port mapping) */
+const SERVICE_DEFAULTS = {
+	postgres: {
+		host: "localhost",
+		port: 5432,
+		username: "app",
+		database: "app"
+	},
+	redis: {
+		host: "localhost",
+		port: 6379,
+		username: "default"
+	},
+	minio: {
+		host: "localhost",
+		port: 9e3,
+		username: "app",
+		bucket: "app"
+	},
+	mailpit: {
+		host: "localhost",
+		port: 1025,
+		username: "app"
+	},
+	localstack: {
+		host: "localhost",
+		port: 4566,
+		username: "localstack",
+		region: "us-east-1"
+	}
+};
+/** Default credentials for pgboss (not a Docker service, reuses postgres) */
+const PGBOSS_DEFAULTS = {
+	host: "localhost",
+	port: 5432,
+	username: "pgboss",
+	database: "app"
+};
+/**
+* Generate credentials for a specific service.
+*/
+function generateServiceCredentials(service) {
+	return {
+		...SERVICE_DEFAULTS[service],
+		password: generateSecurePassword()
+	};
+}
+/**
+* Generate credentials for multiple services.
+*/
+function generateServicesCredentials(services) {
+	const result = {};
+	for (const service of services) result[service] = generateServiceCredentials(service);
+	return result;
+}
+/**
+* Generate connection URL for PostgreSQL.
+*/
+function generatePostgresUrl(creds) {
+	const { username, password, host, port, database } = creds;
+	return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
+}
+/**
+* Generate connection URL for Redis.
+*/
+function generateRedisUrl(creds) {
+	const { password, host, port } = creds;
+	return `redis://:${encodeURIComponent(password)}@${host}:${port}`;
+}
+/**
+* Generate endpoint URL for MinIO (S3-compatible).
+*/
+function generateMinioEndpoint(creds) {
+	const { host, port } = creds;
+	return `http://${host}:${port}`;
+}
+/**
+* Generate connection URL for pg-boss (uses PostgreSQL protocol).
+* Format: pgboss://user:pass@host:port/db?schema=pgboss
+*/
+function generatePgBossUrl(creds) {
+	const { username, password, host, port, database } = creds;
+	return `pgboss://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=pgboss`;
+}
+/**
+* Generate connection URLs from service credentials.
+*/
+function generateConnectionUrls(services) {
+	const urls = {};
+	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
+	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
+	if (services.minio) urls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);
+	if (services.pgboss) {
+		const pgbossUrl = generatePgBossUrl(services.pgboss);
+		urls.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
+		urls.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
+	}
+	if (services.mailpit) {
+		urls.SMTP_HOST = services.mailpit.host;
+		urls.SMTP_PORT = String(services.mailpit.port);
+	}
+	return urls;
+}
+/**
+* Create a new StageSecrets object with generated credentials.
+* @param stage - The deployment stage (e.g., 'development', 'production')
+* @param services - List of services to generate credentials for
+* @param options - Optional configuration
+* @param options.projectName - Project name used to derive the database name (e.g., 'myapp' → 'myapp_dev')
+*/
+function createStageSecrets(stage, services, options) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const serviceCredentials = generateServicesCredentials(services);
+	if (options?.projectName) {
+		if (serviceCredentials.postgres) serviceCredentials.postgres.database = `${options.projectName.replace(/-/g, "_")}_dev`;
+		if (serviceCredentials.minio) {
+			serviceCredentials.minio.bucket = options.projectName;
+			serviceCredentials.minio.username = options.projectName;
+		}
+	}
+	if (serviceCredentials.postgres && !serviceCredentials.pgboss) serviceCredentials.pgboss = {
+		...PGBOSS_DEFAULTS,
+		password: generateSecurePassword(),
+		host: serviceCredentials.postgres.host,
+		port: serviceCredentials.postgres.port,
+		database: serviceCredentials.postgres.database
+	};
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: serviceCredentials,
+		urls: generateConnectionUrls(serviceCredentials),
+		custom: {}
+	};
+}
+/**
+* Rotate password for a specific service.
+*/
+function rotateServicePassword(secrets, service) {
+	const currentCreds = secrets.services[service];
+	if (!currentCreds) throw new Error(`Service "${service}" not configured in secrets`);
+	const newCreds = {
+		...currentCreds,
+		password: generateSecurePassword()
+	};
+	const newServices = {
+		...secrets.services,
+		[service]: newCreds
+	};
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		services: newServices,
+		urls: generateConnectionUrls(newServices)
+	};
+}
+//#endregion
 //#region src/migrate/names.ts
 /**
 * What a migration file is called: a UTC timestamp, then a name.
@@ -8798,26 +9543,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.36",
-	"@geekmidas/auth": "~10.0.0-alpha.36",
-	"@geekmidas/cache": "~10.0.0-alpha.36",
-	"@geekmidas/client": "~10.0.0-alpha.36",
-	"@geekmidas/cloud": "~10.0.0-alpha.36",
-	"@geekmidas/constructs": "~10.0.0-alpha.36",
-	"@geekmidas/db": "~10.0.0-alpha.36",
-	"@geekmidas/emailkit": "~10.0.0-alpha.36",
-	"@geekmidas/envkit": "~10.0.0-alpha.36",
-	"@geekmidas/errors": "~10.0.0-alpha.36",
-	"@geekmidas/events": "~10.0.0-alpha.36",
-	"@geekmidas/logger": "~10.0.0-alpha.36",
-	"@geekmidas/manifest": "~10.0.0-alpha.36",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.36",
-	"@geekmidas/schema": "~10.0.0-alpha.36",
-	"@geekmidas/services": "~10.0.0-alpha.36",
-	"@geekmidas/storage": "~10.0.0-alpha.36",
-	"@geekmidas/studio": "~10.0.0-alpha.36",
-	"@geekmidas/telescope": "~10.0.0-alpha.36",
-	"@geekmidas/testkit": "~10.0.0-alpha.36",
+	"@geekmidas/audit": "~10.0.0-alpha.38",
+	"@geekmidas/auth": "~10.0.0-alpha.38",
+	"@geekmidas/cache": "~10.0.0-alpha.38",
+	"@geekmidas/client": "~10.0.0-alpha.38",
+	"@geekmidas/cloud": "~10.0.0-alpha.38",
+	"@geekmidas/constructs": "~10.0.0-alpha.38",
+	"@geekmidas/db": "~10.0.0-alpha.38",
+	"@geekmidas/emailkit": "~10.0.0-alpha.38",
+	"@geekmidas/envkit": "~10.0.0-alpha.38",
+	"@geekmidas/errors": "~10.0.0-alpha.38",
+	"@geekmidas/events": "~10.0.0-alpha.38",
+	"@geekmidas/logger": "~10.0.0-alpha.38",
+	"@geekmidas/manifest": "~10.0.0-alpha.38",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.38",
+	"@geekmidas/schema": "~10.0.0-alpha.38",
+	"@geekmidas/services": "~10.0.0-alpha.38",
+	"@geekmidas/storage": "~10.0.0-alpha.38",
+	"@geekmidas/studio": "~10.0.0-alpha.38",
+	"@geekmidas/telescope": "~10.0.0-alpha.38",
+	"@geekmidas/testkit": "~10.0.0-alpha.38",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -9389,16 +10134,7 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
-	const stageSecrets = sst ? `${credentials}
-      # The stage's secrets, from SSM in the account the role belongs to —
-      # pushed there once with \`gkm secrets:push --stage <stage> --profile …\`.
-      # The stage reaches the shell as a variable, never pasted into the script:
-      # on a manual run it is whatever was typed.
-      - name: Stage secrets
-        run: ${pm.exec} gkm secrets:pull --stage "$STAGE"
-        env:
-          STAGE: \${{ matrix.stage }}
-` : `
+	const stageSecrets = sst ? credentials : `
       # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
       # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
       # gitignored, so a checkout has the key but not the file: set
@@ -10824,7 +11560,7 @@ function secretsStore(options) {
 	if (options.deployTarget !== "sst" || !options.region) return "";
 	return `
     // Deployed stages keep their secrets in SSM, in the account each stage
-    // deploys to: \`gkm secrets:push --stage <stage> --profile <profile>\`.
+    // deploys to: \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
     store: { provider: 'ssm', region: '${options.region}' },`;
 }
 /**
@@ -14732,7 +15468,7 @@ async function initCommand(projectName, options = {}) {
 		customSecrets.BETTER_AUTH_TRUSTED_ORIGINS = "http://localhost:3000,http://localhost:3001";
 	}
 	devSecrets.custom = customSecrets;
-	await writeStageSecrets(devSecrets, targetDir);
+	await new FileSecretsStore(targetDir).write(local, devSecrets);
 	const keyPath = getKeyPath(local, name);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
@@ -14885,15 +15621,104 @@ var NotAnAwsRegion = class extends Error {
 	}
 };
 //#endregion
+//#region src/setup/fullstack-secrets.ts
+/**
+* Generate a secure random password for database users.
+* Uses a combination of timestamp and random bytes for uniqueness.
+*/
+function generateDbPassword() {
+	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+}
+/**
+* Generate database URL for an app.
+* All apps connect to the same database, but use different users/schemas.
+*/
+function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
+	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
+}
+/**
+* Generate fullstack-aware custom secrets for a workspace.
+*
+* Generates:
+* - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
+*   decides that; see `gkm init`)
+* - Per-app database passwords and URLs for backend apps with db service
+* - Better-auth secrets for apps using the better-auth framework
+*/
+function generateFullstackCustomSecrets(workspace, containers = []) {
+	const hasDb = containers.includes("postgres");
+	const customs = {
+		PORT: "3000",
+		LOG_LEVEL: "debug",
+		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
+	};
+	if (!hasDb) return customs;
+	const frontendPorts = [];
+	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
+		if (appConfig.type === "web") {
+			frontendPorts.push(appConfig.port);
+			const upperName = appName.toUpperCase();
+			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
+			continue;
+		}
+		if (appConfig.type === "mobile") continue;
+		const password = generateDbPassword();
+		const upperName = appName.toUpperCase();
+		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
+		customs[`${upperName}_DB_PASSWORD`] = password;
+		if (appConfig.framework === "better-auth") {
+			customs.AUTH_PORT = String(appConfig.port);
+			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
+			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;
+			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
+		}
+	}
+	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
+	return customs;
+}
+/**
+* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
+*
+* The docker/.env file contains database passwords that the PostgreSQL
+* init script reads to create per-app database users.
+*/
+async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
+	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
+	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
+	if (dbPasswordEntries.length === 0) return;
+	const envContent = `# Auto-generated docker environment file
+# Contains database passwords for docker-compose postgres init
+# This file is gitignored - do not commit to version control
+${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
+`;
+	const envPath = join(workspaceRoot, "docker", ".env");
+	await mkdir(dirname(envPath), { recursive: true });
+	await writeFile(envPath, envContent);
+}
+//#endregion
 //#region src/secrets/index.ts
 const logger$2 = console;
 /**
+* The store the stage named on the command line keeps its secrets in — SSM in
+* its account, for a deployed stage kept there. Outside any workspace nothing
+* names a store, so it is the file.
+*/
+async function storeFor(stage) {
+	try {
+		return await secretsStoreFor(await loadWorkspaceSettings(), stage);
+	} catch (error) {
+		if (error instanceof ConfigNotFound) return new FileSecretsStore(process.cwd());
+		throw error;
+	}
+}
+/**
 * Initialize secrets for a stage.
 * Generates secure random passwords for configured services.
 */
 async function secretsInitCommand(options) {
 	const { stage, force } = options;
-	if (!force && secretsExist(stage)) {
+	const store = await storeFor(stage);
+	if (!force && await store.read(stage)) {
 		logger$2.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
 		process.exit(1);
 	}
@@ -14909,9 +15734,9 @@ async function secretsInitCommand(options) {
 	} catch {}
 	const secrets = createStageSecrets(stage, [], { projectName });
 	if (workspaceSecrets) secrets.custom = workspaceSecrets;
-	await writeStageSecrets(secrets);
+	await store.write(stage, secrets);
 	logger$2.log(`\n✓ Secrets initialized for stage "${stage}"`);
-	logger$2.log(`  Location: .gkm/secrets/${stage}.json`);
+	logger$2.log(`  Store: ${store.name}`);
 	if (secrets.urls.DATABASE_URL) logger$2.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
 	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
@@ -14946,20 +15771,21 @@ async function secretsSetCommand(key, value, options) {
 			process.exit(1);
 		}
 	}
-	try {
-		await setCustomSecret(stage, key, secretValue);
-		logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
-	} catch (error) {
-		logger$2.error(error instanceof Error ? error.message : "Failed to set secret");
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
+	if (!secrets) {
+		logger$2.error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
+	await store.write(stage, withCustomSecret(secrets, key, secretValue));
+	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /**
 * Show secrets for a stage.
 */
 async function secretsShowCommand(options) {
 	const { stage, reveal } = options;
-	const secrets = await readStageSecrets(stage);
+	const secrets = await (await storeFor(stage)).read(stage);
 	if (!secrets) {
 		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
@@ -14992,7 +15818,8 @@ async function secretsShowCommand(options) {
 */
 async function secretsRotateCommand(options) {
 	const { stage, service } = options;
-	const secrets = await readStageSecrets(stage);
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
 	if (!secrets) {
 		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
@@ -15003,13 +15830,13 @@ async function secretsRotateCommand(options) {
 			process.exit(1);
 		}
 		const updated = rotateServicePassword(secrets, service);
-		await writeStageSecrets(updated);
+		await store.write(stage, updated);
 		logger$2.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
 	} else {
 		let updated = secrets;
 		const services = Object.keys(secrets.services);
 		for (const svc of services) updated = rotateServicePassword(updated, svc);
-		await writeStageSecrets(updated);
+		await store.write(stage, updated);
 		logger$2.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
 	}
 	logger$2.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
@@ -15033,7 +15860,8 @@ async function secretsImportCommand(file, options) {
 		logger$2.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
 		process.exit(1);
 	}
-	const secrets = await readStageSecrets(stage);
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
 	if (!secrets) {
 		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
@@ -15047,7 +15875,7 @@ async function secretsImportCommand(file, options) {
 		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		custom: updatedCustom
 	};
-	await writeStageSecrets(updated);
+	await store.write(stage, updated);
 	const importedCount = Object.keys(importedSecrets).length;
 	const totalCount = Object.keys(updatedCustom).length;
 	logger$2.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
@@ -15068,121 +15896,6 @@ function maskUrl(url) {
 	}
 }
 //#endregion
-//#region src/secrets/store.ts
-/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */
-var FileSecretsStore = class {
-	root;
-	constructor(root) {
-		this.root = root;
-	}
-	pull(stage) {
-		return readStageSecrets(stage, this.root);
-	}
-	push(_stage, secrets) {
-		return writeStageSecrets(secrets, this.root);
-	}
-};
-/**
-* The store a stage's secrets live in.
-*
-* The local stage is always the file: its secrets belong to the machine
-* running `gkm dev`. A deployed stage uses `secrets.store`.
-*/
-async function secretsStoreFor(workspace, stage, options = {}) {
-	const configured = workspace.secrets.store ?? "file";
-	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root);
-	if (configured.provider !== "ssm") return configured.provider;
-	const { SsmSecretsStore } = await import("./ssm-BKN1Cg4z.mjs");
-	return new SsmSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
-}
-/** Whether a stage's secrets live somewhere other than this machine. */
-function isRemoteStore(workspace, stage) {
-	const configured = workspace.secrets.store ?? "file";
-	return stage !== workspace.stages.local && configured !== "file";
-}
-//#endregion
-//#region src/secrets/transfer.ts
-/**
-* Moving a deployed stage's secrets between this machine and its store.
-*
-* `push` sends the encrypted local copy to the stage's store; `pull` brings it
-* back and writes the local copy a deploy reads — generating a key for it if
-* the machine has none, which is what a fresh CI runner needs. Both reconcile
-* the keys the workspace now derives, so a store never lags a new construct.
-*/
-var transfer_exports = /* @__PURE__ */ __exportAll({
-	NoLocalSecrets: () => NoLocalSecrets,
-	NoRemoteSecretsStore: () => NoRemoteSecretsStore,
-	NoStoredSecrets: () => NoStoredSecrets,
-	pullStageSecrets: () => pullStageSecrets,
-	pushStageSecrets: () => pushStageSecrets
-});
-/** A push or pull for a stage with nowhere to push or pull from. */
-var NoRemoteSecretsStore = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`Stage "${stage}" keeps its secrets in the local file, so there is nothing to push or pull. Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.`);
-		this.stage = stage;
-		this.name = "NoRemoteSecretsStore";
-	}
-};
-/** A push for a stage whose secrets this machine does not have. */
-var NoLocalSecrets = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`No secrets for stage "${stage}" on this machine. Run gkm secrets:init --stage ${stage} first.`);
-		this.stage = stage;
-		this.name = "NoLocalSecrets";
-	}
-};
-/** A pull for a stage the store holds nothing for. */
-var NoStoredSecrets = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The store holds no secrets for stage "${stage}". Push them first: gkm secrets:push --stage ${stage}.`);
-		this.stage = stage;
-		this.name = "NoStoredSecrets";
-	}
-};
-async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await import("./workspace-EmXwO2qM.mjs").then((n) => n.a);
-	const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
-	return result ? {
-		secrets: result.secrets,
-		addedKeys: result.addedKeys
-	} : {
-		secrets,
-		addedKeys: []
-	};
-}
-function remoteOnly(workspace, stage) {
-	assertDeployedStage(workspace.stages, stage);
-	if (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);
-}
-/** Send this machine's secrets for a deployed stage to its store. */
-async function pushStageSecrets(workspace, stage, options = {}) {
-	remoteOnly(workspace, stage);
-	const local = await readStageSecrets(stage, workspace.root);
-	if (!local) throw new NoLocalSecrets(stage);
-	const result = await reconcile(local, workspace, stage);
-	if (result.addedKeys.length) await writeStageSecrets(result.secrets, workspace.root);
-	await (await secretsStoreFor(workspace, stage, options)).push(stage, result.secrets);
-	return result;
-}
-/** Bring a deployed stage's secrets from its store into the local copy. */
-async function pullStageSecrets(workspace, stage, options = {}) {
-	remoteOnly(workspace, stage);
-	const stored = await (await secretsStoreFor(workspace, stage, options)).pull(stage);
-	if (!stored) throw new NoStoredSecrets(stage);
-	const result = await reconcile(stored, workspace, stage);
-	await writeStageSecrets(result.secrets, workspace.root);
-	return result;
-}
-//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ __exportAll({
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
@@ -15264,30 +15977,18 @@ async function reconcileLocal(workspace, stage, options) {
 async function resolveSecrets(stage, workspace, options) {
 	if (options.force) {
 		logger$1.log("🔐 Generating fresh secrets (--force)...");
-		return generateFreshSecrets(stage, workspace, options);
+		return generateFreshSecrets(stage, workspace);
 	}
-	if (secretsExist(stage, workspace.root)) {
-		logger$1.log("🔐 Using existing local secrets");
-		const secrets = await readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			const reconciled = reconcileSecrets(secrets, workspace, await derivedContainers(workspace, stage));
-			if (reconciled) await writeStageSecrets(reconciled, workspace.root);
-			return reconciled ?? secrets;
-		}
-	}
-	if (isRemoteStore(workspace, stage)) {
-		logger$1.log("☁️  Checking the secrets store...");
-		try {
-			const { secrets } = await pullStageSecrets(workspace, stage);
-			logger$1.log("✅ Pulled secrets from the store");
-			return secrets;
-		} catch (error) {
-			if (error instanceof NoStoredSecrets) logger$1.log("   The store holds none yet");
-			else logger$1.warn(`⚠️  Could not pull from the store: ${error.message}`);
-		}
+	const store = await secretsStoreFor(workspace, stage);
+	const secrets = await store.read(stage);
+	if (secrets) {
+		logger$1.log("🔐 Using existing secrets");
+		const reconciled = reconcileSecrets(secrets, workspace, await derivedContainers(workspace, stage));
+		if (reconciled) await store.write(stage, reconciled);
+		return reconciled ?? secrets;
 	}
 	logger$1.log("🔐 Generating fresh development secrets...");
-	return generateFreshSecrets(stage, workspace, options);
+	return generateFreshSecrets(stage, workspace);
 }
 /**
 * Reconcile existing secrets with expected workspace-derived keys.
@@ -15381,8 +16082,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 * @internal Exported for reuse by `gkm test` auto-setup.
 */
 function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
-	const serviceNames = credentialedServices(containers);
-	const secrets = createStageSecrets(stage, serviceNames, { projectName: workspace.name });
+	const secrets = createStageSecrets(stage, credentialedServices(containers), { projectName: workspace.name });
 	if (Object.keys(workspace.apps).length > 1) secrets.custom = generateFullstackCustomSecrets(workspace, containers);
 	else secrets.custom = {
 		PORT: "3000",
@@ -15397,38 +16097,26 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 *
 * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a
 * committed secrets file or a shared encryption key — the stage is regenerated
-* from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.
+* from the committed `gkm.config.ts`, and the file store mints a local key.
 *
 * @returns true if fresh secrets were generated, false if existing ones were kept
 */
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await loadWorkspaceConfig(cwd);
-	if (secretsExist(stage, workspace.root)) return false;
+	const store = await secretsStoreFor(workspace, stage);
+	if (await store.read(stage)) return false;
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await derivedContainers(workspace, stage));
-	await writeStageSecrets(secrets, workspace.root);
+	await store.write(stage, secrets);
 	return true;
 }
 /**
 * Generate fresh secrets for the workspace.
 */
-async function generateFreshSecrets(stage, workspace, options) {
+async function generateFreshSecrets(stage, workspace) {
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await derivedContainers(workspace, stage));
-	await writeStageSecrets(secrets, workspace.root);
-	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (isRemoteStore(workspace, stage) && !options.yes) {
-		const { shouldPush } = await prompts({
-			type: "confirm",
-			name: "shouldPush",
-			message: `Push the "${stage}" secrets to its store?`,
-			initial: true
-		});
-		if (shouldPush) try {
-			await pushStageSecrets(workspace, stage);
-			logger$1.log("☁️  Secrets pushed to the store");
-		} catch (error) {
-			logger$1.warn(`⚠️  Could not push to the store: ${error.message}`);
-		}
-	}
+	const store = await secretsStoreFor(workspace, stage);
+	await store.write(stage, secrets);
+	logger$1.log(`   Secrets written to the "${stage}" store (${store.name})`);
 	return secrets;
 }
 /**
@@ -15448,6 +16136,56 @@ function printSummary(workspace, stage) {
 	logger$1.log("");
 }
 //#endregion
+//#region src/test/teardown.ts
+/**
+* Dropping the test stage's databases when a suite ends.
+*
+* Reconcile never drops — the line it draws is at data. The test stage's data
+* is the exception: every test runs in a transaction rolled back after it, so
+* nothing in these databases is anyone's, and a database kept between runs is
+* one whose migrations already ran — an edited migration is never applied to
+* it again. So each run starts from a database it created, and drops it when
+* the suite ends: the Vitest global setup's teardown.
+*/
+/**
+* Drop the databases the last setup recorded, and forget the test stage's
+* reconcile, so the next run provisions them from nothing.
+*
+* A no-op when nothing is recorded — no run yet, or one already torn down —
+* so running it twice, or before a setup, is harmless.
+*/
+async function dropTestDatabases(cwd, root, sql = pgClient) {
+	const readyPath = join(cwd, TEST_READY_FILE);
+	const ready = await readReady(readyPath);
+	const recorded = ready?.databases;
+	if (!ready || !recorded) return [];
+	const client = sql(recorded.port);
+	for (const name of recorded.names) {
+		if (!name.endsWith(`_test`)) throw new NotATestDatabase(name);
+		await client.query(void 0, `DROP DATABASE IF EXISTS ${quoteIdentifier(name)} WITH (FORCE)`);
+	}
+	await forgetState(root, TEST_STAGE);
+	const { databases: _dropped, ...rest } = ready;
+	await writeFile(readyPath, JSON.stringify(rest, null, 2));
+	return recorded.names;
+}
+async function readReady(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf-8"));
+	} catch {
+		return;
+	}
+}
+/** A name recorded for the test stage without the test stage's suffix. */
+var NotATestDatabase = class extends Error {
+	database;
+	constructor(database) {
+		super(`Refusing to drop '${database}': only the test stage's databases (named '…_${TEST_STAGE}') are dropped after a suite. Delete ${TEST_READY_FILE} if it was edited by hand.`);
+		this.database = database;
+		this.name = "NotATestDatabase";
+	}
+};
+//#endregion
 //#region src/test/index.ts
 /**
 * Run tests with secrets, dependency URLs, and .env files loaded.
@@ -15456,6 +16194,10 @@ function printSummary(workspace, stage) {
 async function testCommand(options = {}) {
 	const cwd = process.cwd();
 	const stage = options.stage ?? await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
+	if (options.teardown) {
+		await teardown(cwd);
+		return;
+	}
 	if (!stage) throw new NoStageToTest();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	if (options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP)) {
@@ -15464,6 +16206,7 @@ async function testCommand(options = {}) {
 	}
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (!options.prepare) await teardown(cwd);
 	const result = await prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
@@ -15504,7 +16247,8 @@ async function testCommand(options = {}) {
 	const readyPath = join(cwd, TEST_READY_FILE);
 	await writeFile(readyPath, JSON.stringify({
 		env: result.secretsJsonPath,
-		...manifestPath ? { manifest: manifestPath } : {}
+		...manifestPath ? { manifest: manifestPath } : {},
+		...testDatabases(result.reconciled)
 	}, null, 2));
 	if (options.setup) {
 		console.log(`  🧪 Test stage ready: ${TEST_READY_FILE}`);
@@ -15543,12 +16287,29 @@ async function testCommand(options = {}) {
 		});
 	});
 }
+/** Drop what the last setup created — see `dropTestDatabases`. */
+async function teardown(cwd) {
+	const dropped = await dropTestDatabases(cwd, await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.root).catch(() => cwd));
+	if (dropped.length > 0) console.log(`  🧹 Dropped ${dropped.join(", ")}`);
+}
+/**
+* The test stage's Postgres databases, to drop when the suite ends — those
+* the plan provisions, on the port the shared container answers.
+*/
+function testDatabases(reconciled) {
+	const port = reconciled?.ports[primaryPortKey("postgres")];
+	const names = (reconciled?.plan.resources ?? []).filter((resource) => resource.kind === "database" && resource.provisions && resource.container === "postgres").map((resource) => resource.name);
+	return port !== void 0 && names.length > 0 ? { databases: {
+		port,
+		names
+	} } : {};
+}
 /**
 * Migrate the test stage just reconciled, then seed it: a test run never
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CT8b3nt_.mjs");
+	const { migrateAndSeed } = await import("./migrate-C2aYSZTn.mjs");
 	const { discover } = await import("./discover-CMxesskG.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -15948,7 +16709,7 @@ program.command("build").description("Build handlers and the manifest from decla
 		process.exit(1);
 	}
 });
-program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").action(async (options) => {
+program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").option("--fake", "Call each external API’s fake (test/fakes/<id>.ts) instead of the provider").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15959,7 +16720,8 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 			entry: options.entry,
 			watch: options.watch,
 			migrate: options.migrate,
-			seed: options.seed
+			seed: options.seed,
+			fake: options.fake
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -15976,7 +16738,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").option("--teardown", "Drop the test stage's databases the last setup created, then stop — what @geekmidas/cli/vitest runs when the suite ends").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15993,7 +16755,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CT8b3nt_.mjs");
+		const { migrateCommand } = await import("./migrate-C2aYSZTn.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16007,7 +16769,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CT8b3nt_.mjs");
+		const { seedCommand } = await import("./migrate-C2aYSZTn.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16021,7 +16783,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CT8b3nt_.mjs");
+		const { migrationCommand } = await import("./migrate-C2aYSZTn.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16145,57 +16907,28 @@ program.command("secrets:import").description("Import secrets from a JSON file")
 		process.exit(1);
 	}
 });
-program.command("secrets:push").description("Send a deployed stage's secrets to its store (secrets.store)").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
-	try {
-		const globalOptions = program.opts();
-		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushStageSecrets } = await Promise.resolve().then(() => transfer_exports);
-		const { workspace } = await loadWorkspaceConfig();
-		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
-		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
-		console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
-	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
-	}
-});
-program.command("secrets:pull").description("Bring a deployed stage's secrets from its store into the local copy").requiredOption("--stage <stage>", "A deployed stage").option("--profile <profile>", "AWS profile for the stage's account").action(async (options) => {
-	try {
-		const globalOptions = program.opts();
-		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullStageSecrets } = await Promise.resolve().then(() => transfer_exports);
-		const { workspace } = await loadWorkspaceConfig();
-		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
-		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
-		console.log(`\n✓ Secrets pulled for stage "${options.stage}"`);
-	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
-	}
-});
 program.command("secrets:reconcile").description("Backfill missing custom secrets from workspace config").option("--stage <stage>", "Stage name (default: stages.local)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-yNq6Shau.mjs").then((n) => n.n);
-		const { readStageSecrets, writeStageSecrets } = await import("./storage-BjTLjDDp.mjs").then((n) => n.a);
+		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
+		const { secretsStoreFor } = await import("./store-DeGATCS-.mjs").then((n) => n.r);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
-		const secrets = await readStageSecrets(stage, workspace.root);
+		const store = await secretsStoreFor(workspace, stage);
+		const secrets = await store.read(stage);
 		if (!secrets) {
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-EmXwO2qM.mjs").then((n) => n.a);
+		const { derivedContainers } = await import("./workspace-Lm6dv2nz.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
 			return;
 		}
-		await writeStageSecrets(result.secrets, workspace.root);
+		await store.write(stage, result.secrets);
 		console.log(`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${stage}":`);
 		for (const key of result.addedKeys) console.log(`    + ${key}`);
 	} catch (error) {
@@ -16248,7 +16981,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-C99BMxf0.mjs");
+		const { deployGithubCommand } = await import("./github-BPfmXtqk.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16373,6 +17106,6 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
-export { encryption_exports as a, stamp as i, isRemoteStore as n, getHostingerToken as o, slug as r, pushStageSecrets as t };
+export { getHostingerToken as a, encryption_exports as i, slug as n, stamp as r, generateFullstackCustomSecrets as t };
 
 //# sourceMappingURL=index.mjs.map