@geekmidas/cli 10.0.0-alpha.54 → 10.0.0-alpha.56

package/dist/index.cjs

@@ -2,15 +2,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-DXNviAh-.cjs");
-const require_config = require("./config-Cvr5fCbn.cjs");
-const require_workspace = require("./workspace-BcCiLzTO.cjs");
+const require_config = require("./config-CP6wsLHA.cjs");
+const require_workspace = require("./workspace-BpdXIeWV.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_workspace$1 = require("./workspace-DFYu-iRP.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BN0PIZxd.cjs");
+const require_workspace$1 = require("./workspace-BbPJVCto.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BLRQ7Iu9.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-VkNwfJu7.cjs");
-const require_backends = require("./backends-D5aDWxuA.cjs");
+const require_ready = require("./ready-MUhVJDHe.cjs");
+const require_backends = require("./backends-_gQdAzBK.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -20,10 +20,10 @@ let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let node_path = require("node:path");
-let node_child_process = require("node:child_process");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let fast_glob = require("fast-glob");
 fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
+let node_child_process = require("node:child_process");
 let node_module = require("node:module");
 let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
@@ -48,7 +48,7 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.54";
+var version = "10.0.0-alpha.56";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -394,12 +394,12 @@ function withOwningTsconfigJsx(nodeOptions = "") {
 * unhelpful.
 *
 * A separate command rather than part of `gkm setup`, for one reason: this
-* needs `sudo`, and a setup that silently escalates on every run is a worse
-* trade than one that tells you what to type. Caddy's own `caddy trust` draws
-* the line in the same place.
+* asks for a password, and a setup that silently escalates on every run is a
+* worse trade than one that tells you what to type. Caddy's own `caddy trust`
+* draws the line in the same place.
 */
 const logger$11 = console;
-const run = (0, node_util.promisify)(node_child_process.execFile);
+const run$1 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * How each platform is told about a new authority.
 *
@@ -410,15 +410,14 @@ const run = (0, node_util.promisify)(node_child_process.execFile);
 */
 function installation(platform, certificate) {
 	if (platform === "darwin") return {
-		describe: "the System keychain",
-		steps: [["sudo", [
-			"security",
+		describe: "your login keychain",
+		asks: "macOS asks once — your password or Touch ID — to change trust settings.",
+		steps: [["security", [
 			"add-trusted-cert",
-			"-d",
 			"-r",
 			"trustRoot",
 			"-k",
-			"/Library/Keychains/System.keychain",
+			(0, node_path.join)((0, node_os.homedir)(), "Library/Keychains/login.keychain-db"),
 			certificate
 		]]]
 	};
@@ -426,6 +425,7 @@ function installation(platform, certificate) {
 		const debian = (0, node_fs.existsSync)("/usr/local/share/ca-certificates");
 		return {
 			describe: debian ? "the system CA bundle" : "the system trust anchors",
+			asks: "This needs sudo: the system trust store is the only one.",
 			steps: debian ? [["sudo", [
 				"cp",
 				certificate,
@@ -449,15 +449,15 @@ async function trustCommand(options = {}) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
 	const certificate = (0, node_path.join)(workspace.root, require_workspace$1.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
-	const { describe, steps } = installation(process.platform, certificate);
+	const { describe, asks, steps } = installation(process.platform, certificate);
 	logger$11.log(`\n🔐 Trusting the local authority in ${describe}`);
 	logger$11.log(`   ${certificate}\n`);
 	if (options.dryRun) {
 		for (const [command, args] of steps) logger$11.log(`   ${command} ${args.join(" ")}`);
 		return;
 	}
-	logger$11.log("   This needs an admin password.\n");
-	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
+	logger$11.log(`   ${asks}\n`);
+	for (const [command, args] of steps) await run$1(command, args, { stdio: "inherit" });
 	logger$11.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
 }
 /**
@@ -465,7 +465,7 @@ async function trustCommand(options = {}) {
 *
 * A machine's answer, not the project's: whether a laptop installs a root
 * certificate is its owner's call, so the decision is `--yes`, then what this
-* machine previously answered, then a prompt. Never a silent `sudo` — that is
+* machine previously answered, then a prompt. Never a silent escalation — that is
 * the one thing a setup command should not do on somebody's behalf.
 *
 * Silent and free when the machine already trusts it, which is what makes it
@@ -482,7 +482,7 @@ async function ensureTrusted(root, url, options = {}) {
 		const { install } = await (0, prompts.default)({
 			type: "confirm",
 			name: "install",
-			message: "Trust this project's local certificate authority, so a browser accepts its https addresses? (needs sudo)",
+			message: "Trust this project's local certificate authority, so a browser accepts its https addresses? (asks for your password)",
 			initial: false
 		});
 		if (!install) {
@@ -523,7 +523,7 @@ async function recordDeclined(root) {
 async function isTrusted(url) {
 	const { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;
 	try {
-		await run(process.execPath, [
+		await run$1(process.execPath, [
 			"--use-system-ca",
 			"-e",
 			`fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`
@@ -1339,30 +1339,6 @@ function normalizeTelescopeConfig(config) {
 	};
 }
 /**
-* Normalize studio configuration
-* @internal Exported for testing
-*/
-function normalizeStudioConfig(config) {
-	if (config === false) return;
-	if (typeof config === "string") {
-		const { path: studioPath, importPattern: studioImportPattern } = require_config.parseModuleConfig(config, "studio");
-		return {
-			enabled: true,
-			studioPath,
-			studioImportPattern,
-			path: "/__studio",
-			schema: "public"
-		};
-	}
-	if (!(config === true || config === void 0 || config.enabled !== false)) return;
-	const studioConfig = typeof config === "object" ? config : {};
-	return {
-		enabled: true,
-		path: studioConfig.path ?? "/__studio",
-		schema: studioConfig.schema ?? "public"
-	};
-}
-/**
 * Normalize hooks configuration
 * @internal Exported for testing
 */
@@ -1374,10 +1350,10 @@ function normalizeHooksConfig(config, cwd = process.cwd()) {
 /**
 * What a `--production` build is.
 *
-* A server runs its worker's background work itself — queues polled, crons
-* scheduled, subscribers drained — so the production entry wires all three.
-* The build writes their files on every server build, empty when there is
-* nothing, so including them costs an app without any nothing.
+* Background work — queues polled, crons scheduled, subscribers drained — is
+* included here, and `buildApp` takes it back out when the app serves a
+* RestApi: an API's image answers HTTP and nothing else, and that work belongs
+* to a Worker. The build still writes their files on every server build.
 *
 * @internal Exported for testing
 */
@@ -1439,7 +1415,6 @@ async function devCommand(options) {
 		if (missing.length > 0) logger$9.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const telescope = normalizeTelescopeConfig(config.telescope);
-	const studio = normalizeStudioConfig(config.studio);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
 	const enableOpenApi = require_openapi.resolveOpenApiConfig(config).enabled;
 	const build = (bustCache = false) => quietly(() => buildApp({
@@ -1450,7 +1425,7 @@ async function devCommand(options) {
 		enableOpenApi,
 		cacheBackend: require_backends.cacheBackendFor(require_backends.providerOf(workspace ?? config)),
 		telescope,
-		studio,
+		databaseApi: true,
 		hooks,
 		skipBundle: true,
 		bustCache,
@@ -1483,7 +1458,7 @@ async function devCommand(options) {
 		secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
 		await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
 	}
-	const devServer = new DevServer(options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
+	const devServer = new DevServer(options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, initial.databaseApi, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
 	devServer.label = workspaceAppName ?? "server";
 	devServer.publicUrl = publicUrl;
 	await devServer.start();
@@ -1771,9 +1746,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DN5VM5vy.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DQ54y2WD.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-DN5VM5vy.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DQ54y2WD.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2167,7 +2142,7 @@ var DevServer = class {
 	portExplicit;
 	enableOpenApi;
 	telescope;
-	studio;
+	databaseApi;
 	runtime;
 	appRoot;
 	secretsJsonPath;
@@ -2176,12 +2151,12 @@ var DevServer = class {
 	isRunning = false;
 	actualPort;
 	startTime = Date.now();
-	constructor(requestedPort, portExplicit, enableOpenApi, telescope, studio, runtime = "node", appRoot = process.cwd(), secretsJsonPath, selfServing = false) {
+	constructor(requestedPort, portExplicit, enableOpenApi, telescope, databaseApi, runtime = "node", appRoot = process.cwd(), secretsJsonPath, selfServing = false) {
 		this.requestedPort = requestedPort;
 		this.portExplicit = portExplicit;
 		this.enableOpenApi = enableOpenApi;
 		this.telescope = telescope;
-		this.studio = studio;
+		this.databaseApi = databaseApi;
 		this.runtime = runtime;
 		this.appRoot = appRoot;
 		this.secretsJsonPath = secretsJsonPath;
@@ -2238,7 +2213,7 @@ var DevServer = class {
 			const tools = this.selfServing ? [] : [
 				...this.enableOpenApi ? ["docs /__docs"] : [],
 				...this.telescope ? [`telescope ${this.telescope.path}`] : [],
-				...this.studio ? [`studio ${this.studio.path}`] : []
+				...this.databaseApi ? [`db ${this.databaseApi}`] : []
 			];
 			if (tools.length > 0) logger$9.log(`  ${tools.join(" · ")}`);
 		}
@@ -2744,18 +2719,167 @@ var TopicGenerator = class extends require_discover.ConstructGenerator {
 	}
 };
 //#endregion
+//#region src/run.ts
+/**
+* Start a program with an argument array, never a shell string.
+*
+* `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the
+* workspace — image refs, tags, build args, package names — to `docker` and
+* `turbo`. Joined into a string and handed to a shell, a package named
+* `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which
+* matters most where the CLI builds a repository it didn't write: a CI job for a
+* fork, a shared build runner. Here every value reaches the program as one
+* `argv` element, whatever it contains.
+*/
+/** Long enough for a cold image build; short enough that a hung one ends. */
+const DEFAULT_TIMEOUT_MS = 18e5;
+/** How long a timed-out child has to exit on SIGTERM before it is killed. */
+const KILL_GRACE_MS = 5e3;
+/** The command line as a person would read it — for messages, never to run. */
+function display(command, args) {
+	return [command, ...args].join(" ");
+}
+/** The program ran and exited unsuccessfully; its own output said why. */
+var CommandFailed = class extends Error {
+	command;
+	args;
+	exitCode;
+	signal;
+	constructor(command, args, exitCode, signal) {
+		super(`\`${display(command, args)}\` ${exitCode === null ? `was stopped by ${signal ?? "a signal"}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`);
+		this.command = command;
+		this.args = args;
+		this.exitCode = exitCode;
+		this.signal = signal;
+		this.name = "CommandFailed";
+	}
+};
+/** The program ran past its timeout and was killed. */
+var CommandTimedOut = class extends Error {
+	command;
+	args;
+	timeoutMs;
+	constructor(command, args, timeoutMs) {
+		super(`\`${display(command, args)}\` was still running after ${Math.round(timeoutMs / 1e3)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`);
+		this.command = command;
+		this.args = args;
+		this.timeoutMs = timeoutMs;
+		this.name = "CommandTimedOut";
+	}
+};
+/**
+* Run `command` with `args`, resolving when it exits 0.
+*
+* Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}
+* once `timeoutMs` passes (after the child is gone), and with the spawn error
+* itself when the program cannot be started at all — `ENOENT` already names it.
+*/
+function run(command, args, options = {}) {
+	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(command, [...args], {
+			stdio: "inherit",
+			...spawnOptions,
+			shell: false
+		});
+		let timedOut = false;
+		let killer;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGTERM");
+			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+			killer.unref?.();
+		}, timeoutMs);
+		timer.unref?.();
+		const settle = () => {
+			clearTimeout(timer);
+			if (killer) clearTimeout(killer);
+		};
+		child.on("error", (error) => {
+			settle();
+			reject(error);
+		});
+		child.on("close", (code, signal) => {
+			settle();
+			if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
+			else if (code === 0) resolve();
+			else reject(new CommandFailed(command, args, code, signal));
+		});
+	});
+}
+//#endregion
+//#region src/secrets/encryption.ts
+var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	encryptSecrets: () => encryptSecrets,
+	generateDefineOptions: () => generateDefineOptions,
+	keyFingerprint: () => keyFingerprint
+});
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+/**
+* Encrypt secrets for embedding in a bundle.
+* Uses AES-256-GCM with a randomly generated ephemeral key.
+*
+* @param secrets - Key-value pairs to encrypt
+* @returns Encrypted payload with ephemeral master key
+*/
+function encryptSecrets(secrets) {
+	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const plaintext = JSON.stringify(secrets);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
+		iv: iv.toString("hex"),
+		masterKey: masterKey.toString("hex")
+	};
+}
+/**
+* Generate the define options for tsdown/esbuild.
+* These will be injected at build time.
+*/
+function generateDefineOptions(payload) {
+	return {
+		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
+		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
+	};
+}
+/**
+* A short, one-way name for a master key: the first 8 hex characters of its
+* SHA-256.
+*
+* Printed where the key itself used to be, so a person can tell which key a
+* build used — and match it against the one they hold — without the output
+* carrying a value that decrypts every secret of the stage.
+*/
+function keyFingerprint(masterKey) {
+	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/build/types.ts
+/**
+* Where `gkm dev` serves the database's read-only JSON API
+* (`@geekmidas/db/introspect`). Under `/__gkm` with the rest of what the dev
+* server adds, so it cannot collide with an application route.
+*/
+const DEV_DATABASE_API_PATH = "/__gkm/db";
+//#endregion
 //#region src/build/owners.ts
 /**
 * What a generated entry imports its runtime from, read off the discovered
 * constructs: the surface it serves, every construct a runnable can be built
-* from, and the database Studio browses.
+* from, and the database the dev server's JSON API reads.
 *
 * `gkm build` and `gkm dev` both write entries that import the surface for its
 * logger and environment parser, so both ask here. A dev server that skipped it
 * had nothing to import them from.
 */
 function ownersContext(options) {
-	const { declared, sources, workspaceRoot, appRoot, studio } = options;
+	const { declared, sources, workspaceRoot, appRoot, databaseApi } = options;
 	const surfaces = restApis(declared);
 	const primary = servedSurface(declared, workspaceRoot, appRoot) ?? surfaces.find((d) => d.endpoints.length === 0) ?? surfaces[0];
 	const browsable = Object.entries(declared).find(([, d]) => d.kind === "database");
@@ -2782,13 +2906,13 @@ function ownersContext(options) {
 				exportName: primarySource.exportName
 			} } : {}
 		} } : {},
-		studio: studio && browsableSource ? {
-			...studio,
+		...databaseApi && browsableSource ? { databaseApi: {
+			path: DEV_DATABASE_API_PATH,
 			database: {
 				specifier: browsableSource.file,
 				exportName: browsableSource.exportName
 			}
-		} : studio
+		} } : {}
 	};
 }
 /**
@@ -2874,6 +2998,11 @@ export default app;
 //#region src/build/index.ts
 const logger$8 = console;
 /**
+* Where `gkm build --stage` leaves the key its bundle's secrets were encrypted
+* with, beside the bundle in `.gkm/server/` and readable by its owner alone.
+*/
+const MASTER_KEY_FILE = "master.key";
+/**
 * What a build run at the workspace root reads.
 *
 * One backend app there, and it is that app's config, so its own `openapi`
@@ -2966,8 +3095,6 @@ async function buildOneApp(input) {
 	logger$8.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
 	if (telescope) logger$8.log(`🔭 Telescope enabled at ${telescope.path}`);
-	const studio = production ? void 0 : normalizeStudioConfig(config.studio);
-	if (studio) logger$8.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
 	if (hooks) logger$8.log(`🪝 Server hooks enabled`);
 	return buildApp({
@@ -2979,7 +3106,6 @@ async function buildOneApp(input) {
 		cacheBackend,
 		production,
 		telescope,
-		studio,
 		hooks,
 		markOptional: options.markOptional ?? false,
 		skipBundle: options.skipBundle ?? false,
@@ -3022,7 +3148,7 @@ async function writeManifest(input) {
 * dev did not, and failed on exactly the apps the build had learned to handle.
 */
 async function buildApp(input) {
-	const { config, workspaceRoot, appRoot, target, enableOpenApi, cacheBackend, production, telescope, studio, hooks, bustCache = false } = input;
+	const { config, workspaceRoot, appRoot, target, enableOpenApi, cacheBackend, production, telescope, databaseApi, hooks, bustCache = false } = input;
 	const constructGlobs = config.constructs;
 	const constructSources = {};
 	const declared = constructGlobs ? await require_discover.discover({
@@ -3047,7 +3173,7 @@ async function buildApp(input) {
 		sources: constructSources,
 		workspaceRoot,
 		appRoot,
-		studio
+		databaseApi
 	});
 	const buildContext = {
 		...derived,
@@ -3089,12 +3215,27 @@ async function buildApp(input) {
 		logger$8.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
+	if (production?.subscribers === "include" && derived.surface) {
+		buildContext.production = {
+			...production,
+			subscribers: "exclude"
+		};
+		const left = [
+			[allCrons.length, "cron"],
+			[allQueues.length, "queue consumer"],
+			[allSubscribers.length, "subscriber"]
+		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
+		if (left.length > 0) logger$8.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
+	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
 		root: workspaceRoot
 	});
-	return result;
+	return {
+		...result,
+		...buildContext.databaseApi ? { databaseApi: buildContext.databaseApi.path } : {}
+	};
 }
 async function buildForTarget(target, context, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
 	const outputDir = (0, node_path.join)(appRoot, ".gkm", target);
@@ -3166,8 +3307,11 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 			})).masterKey;
 			logger$8.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
+				const keyPath = (0, node_path.join)(outputDir, MASTER_KEY_FILE);
+				await (0, node_fs_promises.writeFile)(keyPath, `${masterKey}\n`, { mode: 384 });
+				await (0, node_fs_promises.chmod)(keyPath, 384);
 				logger$8.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$8.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
+				logger$8.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${keyFingerprint(masterKey)})`);
 			}
 		}
 		return {
@@ -3190,7 +3334,7 @@ function detectPackageManager$2() {
 	return "npm";
 }
 /**
-* Get the turbo command for running builds.
+* The program and argv that run turbo's build.
 *
 * `filters` names the packages to build. Passing none lets turbo infer its own
 * scope from the working directory, which for a workspace root means the
@@ -3198,14 +3342,24 @@ function detectPackageManager$2() {
 * `gkm build`, inferring is how you get a build that runs itself forever.
 * `workspaceBuildCommand` always names the apps.
 *
+* An array, not a command string: the filters are package names read from the
+* workspace, and each must reach turbo as one argument whatever it holds. Each
+* is `--filter=<name>`, so even a name starting with `-` stays a filter value.
+*
 * @internal Exported for testing
 */
-function getTurboCommand(pm, filters = [], { only = false } = {}) {
-	const filterArgs = (typeof filters === "string" ? [filters] : filters).map((f) => ` --filter=${f}`).join("") + (only ? " --only" : "");
+function getTurboArgs(pm, filters = [], { only = false } = {}) {
+	const turbo = [
+		"turbo",
+		"run",
+		"build",
+		...(typeof filters === "string" ? [filters] : filters).map((f) => `--filter=${f}`),
+		...only ? ["--only"] : []
+	];
 	switch (pm) {
-		case "pnpm": return `pnpm exec turbo run build${filterArgs}`;
-		case "yarn": return `yarn turbo run build${filterArgs}`;
-		case "npm": return `npx turbo run build${filterArgs}`;
+		case "pnpm": return ["pnpm", ["exec", ...turbo]];
+		case "yarn": return ["yarn", turbo];
+		case "npm": return ["npx", turbo];
 	}
 }
 /**
@@ -3294,27 +3448,16 @@ async function workspaceBuildCommand(workspace, options) {
 		const { filters, unpackaged } = turboFilters(workspace, { exclude: "backend" });
 		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
 		const pm = detectPackageManager$2();
-		const turboCommand = getTurboCommand(pm, filters, { only: true });
+		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
 			logger$8.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
-			logger$8.log(`Running: ${turboCommand}`);
-			await new Promise((resolve, reject) => {
-				const child = (0, node_child_process.spawn)(turboCommand, {
-					shell: true,
-					cwd: workspace.root,
-					stdio: "inherit",
-					env: {
-						...process.env,
-						NODE_ENV: options.production ? "production" : "development"
-					}
-				});
-				child.on("close", (code) => {
-					if (code === 0) resolve();
-					else reject(/* @__PURE__ */ new Error(`Turbo build failed with exit code ${code}`));
-				});
-				child.on("error", (err) => {
-					reject(err);
-				});
+			logger$8.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
+			await run(turboBin, turboArgs, {
+				cwd: workspace.root,
+				env: {
+					...process.env,
+					NODE_ENV: options.production ? "production" : "development"
+				}
 			});
 		}
 		for (const [appName, app] of apps) {
@@ -4667,6 +4810,39 @@ function getPublicUrlArgNames(app) {
 	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
 }
 //#endregion
+//#region src/docker/imageRef.ts
+/**
+* An image reference, checked before it reaches `docker`.
+*
+* The parts come from the workspace — a registry in `gkm.config.ts`, an image
+* name from the project, a tag from `--tag` — and an argument array already
+* keeps them out of a shell. What it cannot do is stop `docker` reading a value
+* that starts with `-` as one of its own flags, so a ref is held to Docker's
+* own grammar (distribution/reference) and anything else is refused by name
+* before a build starts.
+*/
+const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
+const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
+const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
+const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
+/** Docker refuses a repository name longer than this. */
+const MAX_NAME_LENGTH = 255;
+/** A value that is not an image reference was about to be built or pushed. */
+var ImageRefInvalid = class extends Error {
+	ref;
+	constructor(ref) {
+		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
+		this.ref = ref;
+		this.name = "ImageRefInvalid";
+	}
+};
+/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
+function validateImageRef(ref) {
+	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
+	return ref;
+}
+//#endregion
 //#region src/docker/templates.ts
 const LOCKFILES = [
 	["pnpm-lock.yaml", "pnpm"],
@@ -5020,6 +5196,10 @@ node_modules
 .gkm/server/*.ts
 !.gkm/server/dist
 
+# The key gkm build --stage encrypted secrets with: runtime env only, never
+# the build context
+.gkm/server/master.key
+
 # IDE and editor
 .idea
 .vscode
@@ -5234,10 +5414,6 @@ FROM deps AS builder
 
 WORKDIR /app
 
-# Build-time args for encrypted secrets
-ARG GKM_ENCRYPTED_CREDENTIALS=""
-ARG GKM_CREDENTIALS_IV=""
-
 # Copy pruned source
 COPY --from=pruner /app/out/full/ ./
 
@@ -5246,11 +5422,15 @@ COPY --from=pruner /app/out/full/ ./
 COPY --from=pruner /app/gkm.config.* ./
 COPY --from=pruner /app/tsconfig.* ./
 
-# Write encrypted credentials for gkm build to embed
-RUN if [ -n "$GKM_ENCRYPTED_CREDENTIALS" ]; then \
+# Write encrypted credentials for gkm build to embed.
+# A build secret (\`docker build --secret id=gkm_credentials,src=…\`), not an
+# ARG: an ARG is recorded in the image history. Two lines, ciphertext then IV;
+# absent when the app has no secrets.
+RUN --mount=type=secret,id=gkm_credentials,required=false \
+    if [ -s /run/secrets/gkm_credentials ]; then \
       mkdir -p ${appPath}/.gkm && \
-      echo "$GKM_ENCRYPTED_CREDENTIALS" > ${appPath}/.gkm/credentials.enc && \
-      echo "$GKM_CREDENTIALS_IV" > ${appPath}/.gkm/credentials.iv; \
+      sed -n 1p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.enc && \
+      sed -n 2p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.iv; \
     fi
 
 # Build any workspace packages the app depends on.
@@ -5337,10 +5517,6 @@ FROM deps AS builder
 
 WORKDIR /app
 
-# Build-time args for encrypted secrets
-ARG GKM_ENCRYPTED_CREDENTIALS=""
-ARG GKM_CREDENTIALS_IV=""
-
 # Copy pruned source
 COPY --from=pruner /app/out/full/ ./
 
@@ -5348,20 +5524,17 @@ COPY --from=pruner /app/out/full/ ./
 # Using wildcard to make it optional for single-app projects
 COPY --from=pruner /app/tsconfig.* ./
 
-# Write encrypted credentials for tsdown to embed via define
-RUN if [ -n "$GKM_ENCRYPTED_CREDENTIALS" ]; then \
-      mkdir -p ${appPath}/.gkm && \
-      echo "$GKM_ENCRYPTED_CREDENTIALS" > ${appPath}/.gkm/credentials.enc && \
-      echo "$GKM_CREDENTIALS_IV" > ${appPath}/.gkm/credentials.iv; \
-    fi
-
 # Bundle entry point with esbuild (outputs to dist/index.mjs)
 # Creates a fully standalone bundle with all dependencies included
-# Use define to embed credentials if present
-RUN cd ${appPath} && \
-    if [ -f .gkm/credentials.enc ]; then \
-      CREDS=$(cat .gkm/credentials.enc) && \
-      IV=$(cat .gkm/credentials.iv) && \
+# Use define to embed credentials if present.
+# They arrive as a build secret (\`docker build --secret id=gkm_credentials,src=…\`),
+# not an ARG: an ARG is recorded in the image history. Two lines, ciphertext
+# then IV; absent when the app has no secrets.
+RUN --mount=type=secret,id=gkm_credentials,required=false \
+    cd ${appPath} && \
+    if [ -s /run/secrets/gkm_credentials ]; then \
+      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \
+      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \
       npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
         --outfile=dist/index.mjs --packages=bundle \
         --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);' \
@@ -5512,6 +5685,33 @@ CMD ["nginx", "-g", "daemon off;"]
 //#endregion
 //#region src/docker/index.ts
 const logger$6 = console;
+/** `docker build` failed; what docker printed above says why. */
+var DockerBuildFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to build Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerBuildFailed";
+	}
+};
+/** `docker push` failed — usually the registry login or its permissions. */
+var DockerPushFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to push Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerPushFailed";
+	}
+};
+/** `gkm docker --push` was asked for with nowhere to push to. */
+var PushNeedsRegistry = class extends Error {
+	imageName;
+	constructor(imageName) {
+		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
+		this.imageName = imageName;
+		this.name = "PushNeedsRegistry";
+	}
+};
 /**
 * Docker command implementation
 * Generates Dockerfile, docker-compose.yml, and related files
@@ -5615,14 +5815,18 @@ function ensureLockfile(cwd) {
 async function buildDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
-	const fullImageName = registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
+	const fullImageName = validateImageRef(registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`);
 	logger$6.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cwd = process.cwd();
 	const cleanup = ensureLockfile(cwd);
 	try {
-		(0, node_child_process.execSync)(`DOCKER_BUILDKIT=1 docker build -f .gkm/docker/Dockerfile -t ${fullImageName} .`, {
+		await run("docker", [
+			"build",
+			"--file=.gkm/docker/Dockerfile",
+			`--tag=${fullImageName}`,
+			"."
+		], {
 			cwd,
-			stdio: "inherit",
 			env: {
 				...process.env,
 				DOCKER_BUILDKIT: "1"
@@ -5630,7 +5834,7 @@ async function buildDockerImage(imageName, options) {
 		});
 		logger$6.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
-		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerBuildFailed(fullImageName, error);
 	} finally {
 		cleanup?.();
 	}
@@ -5641,17 +5845,14 @@ async function buildDockerImage(imageName, options) {
 async function pushDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
-	if (!registry) throw new Error("Registry is required to push Docker image. Use --registry or configure docker.registry in gkm.config.ts");
-	const fullImageName = `${registry}/${imageName}:${tag}`;
+	if (!registry) throw new PushNeedsRegistry(imageName);
+	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger$6.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		(0, node_child_process.execSync)(`docker push ${fullImageName}`, {
-			cwd: process.cwd(),
-			stdio: "inherit"
-		});
+		await run("docker", ["push", fullImageName], { cwd: process.cwd() });
 		logger$6.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
-		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerPushFailed(fullImageName, error);
 	}
 }
 /**
@@ -5783,6 +5984,11 @@ function printRunInstructions(workspace) {
 //#region src/deploy/docker.ts
 const logger$5 = console;
 /**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
 * Get the full image reference
 */
 function getImageRef(registry, imageName, tag) {
@@ -5790,31 +5996,69 @@ function getImageRef(registry, imageName, tag) {
 	return `${imageName}:${tag}`;
 }
 /**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
+	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
+	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
+	await (0, node_fs_promises.chmod)(path, 384);
+	return {
+		path,
+		cleanup: () => (0, node_fs_promises.rm)(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
 * Build Docker image
 * @param imageRef - Full image reference (registry/name:tag)
-* @param appName - Name of the app (used for Dockerfile.{appName} in workspaces)
 * @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
 */
-async function buildImage(imageRef, _appName, buildArgs) {
+async function buildImage(imageRef, buildArgs, credentials) {
 	logger$5.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
 	logger$5.log("   Generating Dockerfile for the pre-built bundle...");
 	await dockerCommand({ slim: true });
 	const dockerfilePath = (0, node_path.join)(cwd, ".gkm", "docker", "Dockerfile");
-	const buildCwd = cwd;
-	const buildArgsString = buildArgs && buildArgs.length > 0 ? buildArgs.map((arg) => `--build-arg "${arg}"`).join(" ") : "";
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
 	try {
-		const cmd = [
-			"DOCKER_BUILDKIT=1 docker build",
-			"--platform linux/amd64",
-			`-f ${dockerfilePath}`,
-			`-t ${imageRef}`,
-			buildArgsString,
-			"."
-		].filter(Boolean).join(" ");
-		(0, node_child_process.execSync)(cmd, {
-			cwd: buildCwd,
-			stdio: "inherit",
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs,
+			credentialsFile: secret?.path
+		}), {
+			cwd,
 			env: {
 				...process.env,
 				DOCKER_BUILDKIT: "1"
@@ -5822,7 +6066,9 @@ async function buildImage(imageRef, _appName, buildArgs) {
 		});
 		logger$5.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
-		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
 	}
 }
 /**
@@ -5831,23 +6077,20 @@ async function buildImage(imageRef, _appName, buildArgs) {
 async function pushImage(imageRef) {
 	logger$5.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
-		(0, node_child_process.execSync)(`docker push ${imageRef}`, {
-			cwd: process.cwd(),
-			stdio: "inherit"
-		});
+		await run("docker", ["push", imageRef], { cwd: process.cwd() });
 		logger$5.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
-		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerPushFailed(imageRef, error);
 	}
 }
 /**
 * Deploy using Docker (build and optionally push image)
 */
 async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs } = options;
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
 	const imageName = config.imageName;
-	const imageRef = getImageRef(config.registry, imageName, tag);
-	await buildImage(imageRef, config.appName, buildArgs);
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	await buildImage(imageRef, buildArgs, credentials);
 	if (!skipPush) {
 		if (!config.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 		else await pushImage(imageRef);
@@ -5856,12 +6099,7 @@ async function deployDocker(options) {
 	logger$5.log(`\n📋 Deployment details:`);
 	logger$5.log(`   Image: ${imageRef}`);
 	logger$5.log(`   Stage: ${stage}`);
-	if (masterKey) {
-		logger$5.log(`\n🔐 Deploy with this environment variable:`);
-		logger$5.log(`   GKM_MASTER_KEY=${masterKey}`);
-		logger$5.log("\n   Example docker run:");
-		logger$5.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
-	}
+	if (masterKey) logger$5.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
 		masterKey
@@ -5886,9 +6124,53 @@ function applicationName(stage, project, app) {
 //#endregion
 //#region src/deploy/dokploy-api.ts
 var dokploy_api_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
 	DokployApi: () => DokployApi,
-	DokployApiError: () => DokployApiError
+	DokployApiError: () => DokployApiError,
+	DokployRequestTimedOut: () => DokployRequestTimedOut
 });
+/** Per request, so a stalled server fails the deploy, not the CI job. */
+const DEFAULT_DOKPLOY_TIMEOUT_MS = 3e4;
+/**
+* Dokploy accepted the connection but did not answer in time.
+*
+* Not retried: a request that arrived and stalled may still be acted on, and
+* sending it again could repeat a deploy or a create the server is already
+* doing.
+*/
+var DokployRequestTimedOut = class extends Error {
+	baseUrl;
+	endpoint;
+	timeoutMs;
+	constructor(baseUrl, endpoint, timeoutMs) {
+		super(`Dokploy at ${baseUrl} did not answer ${endpoint} within ${timeoutMs}ms. Check that the Dokploy server is healthy, or raise \`timeoutMs\` if this call is known to be slow.`);
+		this.baseUrl = baseUrl;
+		this.endpoint = endpoint;
+		this.timeoutMs = timeoutMs;
+		this.name = "DokployRequestTimedOut";
+	}
+};
+/**
+* Waits `ms` between retries, or rejects with the signal's reason the moment
+* it aborts — a caller who gave up should not sit through the backoff.
+*/
+function pause(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
 var DokployApiError = class extends Error {
 	status;
 	statusText;
@@ -5907,9 +6189,13 @@ var DokployApiError = class extends Error {
 var DokployApi = class {
 	baseUrl;
 	token;
+	timeoutMs;
+	signal;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/$/, "");
 		this.token = options.token;
+		this.timeoutMs = options.timeoutMs ?? 3e4;
+		this.signal = options.signal;
 	}
 	/**
 	* Make a GET request to the Dokploy API
@@ -5929,26 +6215,51 @@ var DokployApi = class {
 	async request(method, endpoint, body) {
 		const url = `${this.baseUrl}/api/${endpoint}`;
 		let response;
+		let timeout;
 		let lastError;
-		for (let attempt = 1; attempt <= 3; attempt++) try {
-			response = await fetch(url, {
-				method,
-				headers: {
-					"Content-Type": "application/json",
-					"x-api-key": this.token
-				},
-				body: body ? JSON.stringify(body) : void 0
-			});
-			break;
-		} catch (error) {
-			lastError = error;
-			if (attempt === 3) break;
-			await new Promise((resolve) => setTimeout(resolve, attempt * 750));
+		for (let attempt = 1; attempt <= 3; attempt++) {
+			this.signal?.throwIfAborted();
+			timeout = AbortSignal.timeout(this.timeoutMs);
+			try {
+				response = await fetch(url, {
+					method,
+					headers: {
+						"Content-Type": "application/json",
+						"x-api-key": this.token
+					},
+					body: body ? JSON.stringify(body) : void 0,
+					signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
+				});
+				break;
+			} catch (error) {
+				const stopped = this.stopped(timeout, endpoint);
+				if (stopped) throw stopped;
+				lastError = error;
+				if (attempt === 3) break;
+				await pause(attempt * 750, this.signal);
+			}
 		}
-		if (!response) {
+		if (!response || !timeout) {
 			const detail = lastError instanceof Error ? lastError.message : String(lastError);
 			throw new DokployApiError(`Could not reach Dokploy at ${this.baseUrl} (${endpoint}): ${detail}`, 0, "Network error");
 		}
+		try {
+			return await this.read(response);
+		} catch (error) {
+			throw this.stopped(timeout, endpoint) ?? error;
+		}
+	}
+	/**
+	* What a request cut short should reject with: the caller's own reason
+	* when they aborted, `DokployRequestTimedOut` when the deadline passed,
+	* nothing when it was neither.
+	*/
+	stopped(timeout, endpoint) {
+		if (this.signal?.aborted) return this.signal.reason;
+		if (timeout.aborted) return new DokployRequestTimedOut(this.baseUrl, endpoint, this.timeoutMs);
+	}
+	/** Turns a response into its JSON body, or a `DokployApiError`. */
+	async read(response) {
 		if (!response.ok) {
 			let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
 			let issues;
@@ -6737,7 +7048,11 @@ function isStateProvider(value) {
 *
 * - 'local': LocalStateProvider (default)
 * - 'ssm': CachedStateProvider with SSM as source of truth
+* - 's3': S3StateStore behind the provider interface
 * - Custom: Use provided StateProvider implementation
+*
+* Deploy moves to `createStateStore` (locks, versions, per-resource records);
+* this stays for the call sites that read and write whole states.
 */
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
@@ -6745,6 +7060,11 @@ async function createStateProvider(options) {
 		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
+	const { isStateStore } = await Promise.resolve().then(() => StateStore_exports);
+	if (isStateStore(config.provider)) {
+		const { StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
+		return new StateStoreProvider(config.provider);
+	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
@@ -6752,7 +7072,10 @@ async function createStateProvider(options) {
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
-		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
+		if (!workspaceName) {
+			const { StateStoreNeedsWorkspaceName } = await Promise.resolve().then(() => StateStore_exports);
+			throw new StateStoreNeedsWorkspaceName("ssm");
+		}
 		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
 		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-VrQ-yeqd.cjs"));
 		const { CachedStateProvider } = await Promise.resolve().then(() => CachedStateProvider_exports);
@@ -6764,47 +7087,12 @@ async function createStateProvider(options) {
 			profile: ssmConfig.profile
 		}), local);
 	}
-	throw new Error(`Unknown state provider: ${JSON.stringify(config)}`);
-}
-//#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
+	if (provider === "s3") {
+		const { createStateStore, StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
+		return new StateStoreProvider(await createStateStore(options));
+	}
+	const { UnknownStateProvider } = await Promise.resolve().then(() => StateStore_exports);
+	throw new UnknownStateProvider(config);
 }
 //#endregion
 //#region src/deploy/secrets.ts
@@ -7762,12 +8050,11 @@ async function workspaceDeployCommand(configured, options) {
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const appSecrets = encryptedSecrets.get(appName);
-				const buildArgs = [];
-				if (appSecrets && appSecrets.secretCount > 0) {
-					buildArgs.push(`GKM_ENCRYPTED_CREDENTIALS=${appSecrets.payload.encrypted}`);
-					buildArgs.push(`GKM_CREDENTIALS_IV=${appSecrets.payload.iv}`);
-					logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
-				}
+				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
+					encrypted: appSecrets.payload.encrypted,
+					iv: appSecrets.payload.iv
+				} : void 0;
+				if (appSecrets && credentials) logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
 				logger$4.log(`      Building Docker image: ${imageRef}`);
@@ -7780,7 +8067,7 @@ async function workspaceDeployCommand(configured, options) {
 						imageName,
 						appName
 					},
-					buildArgs
+					credentials
 				});
 				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
@@ -8162,6 +8449,11 @@ async function deployListCommand(options) {
 var CachedStateProvider_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ CachedStateProvider: () => CachedStateProvider });
 /**
 * Cached state provider that wraps a remote provider with local cache.
+*
+* @deprecated for deploys: a read prefers the local copy, so a stale one wins
+* over the remote without warning, and a write overwrites the remote blindly.
+* Deploy uses `createStateStore`, which reads SSM directly and writes
+* conditionally. Kept for `gkm state:pull | push | diff`.
 */
 var CachedStateProvider = class {
 	remote;
@@ -8212,29 +8504,438 @@ var CachedStateProvider = class {
 	}
 };
 //#endregion
-//#region src/deploy/state-commands.ts
+//#region src/deploy/StateStore.ts
 /**
-* State Management CLI Commands
+* Deploy state store.
 *
-* Commands for managing deployment state across local and remote providers.
-*/
-/**
-* Pull state from remote to local.
-* `gkm state:pull --stage=<stage>`
-*/
-async function statePullCommand(options) {
-	const { workspace } = await require_config.loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Add a remote provider in gkm.config.ts:");
-		console.error("  state: { provider: \"ssm\", region: \"us-east-1\" }");
-		process.exit(1);
+* `StateProvider` reads and writes a whole stage at once, with nothing to stop
+* two runs of the same stage from overwriting each other and nowhere to record
+* a resource the moment it exists. A `StateStore` adds the three things a
+* deploy needs to be safe against crashes and concurrent runs:
+*
+* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
+*   holder, instead of racing the first.
+* - Versioned `read` and conditional `write`: a write names the version it was
+*   based on, and raises `StateVersionConflict` when the stored state moved on
+*   underneath it, so nothing is lost silently even without the lock.
+* - Per-resource records: `putResource` journals one resource at a time, so a
+*   run that dies half way leaves behind the ids of everything it created.
+*
+* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
+* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
+* working but cannot lock.
+*/
+var StateStore_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DocumentStateStore: () => DocumentStateStore,
+	STATE_SCHEMA_VERSION: () => 2,
+	StageStateMissing: () => StageStateMissing,
+	StateLocked: () => StateLocked,
+	StateSchemaTooNew: () => StateSchemaTooNew,
+	StateStoreBusy: () => StateStoreBusy,
+	StateStoreNeedsWorkspaceName: () => StateStoreNeedsWorkspaceName,
+	StateStoreProvider: () => StateStoreProvider,
+	StateStoreWithoutLocking: () => StateStoreWithoutLocking,
+	StateUnreadable: () => StateUnreadable,
+	StateVersionConflict: () => StateVersionConflict,
+	UnknownStateProvider: () => UnknownStateProvider,
+	contentVersion: () => contentVersion,
+	createStateStore: () => createStateStore,
+	decodeDocument: () => decodeDocument,
+	encodeDocument: () => encodeDocument,
+	isStateStore: () => isStateStore,
+	migrateV1: () => migrateV1,
+	newLockHolder: () => newLockHolder
+});
+var StateLocked = class extends Error {
+	stage;
+	holder;
+	location;
+	constructor(stage, holder, location) {
+		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
+		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
+		this.stage = stage;
+		this.holder = holder;
+		this.location = location;
+		this.name = "StateLocked";
 	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
+};
+var StateVersionConflict = class extends Error {
+	stage;
+	expectedVersion;
+	actualVersion;
+	constructor(stage, expectedVersion, actualVersion) {
+		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
+		this.stage = stage;
+		this.expectedVersion = expectedVersion;
+		this.actualVersion = actualVersion;
+		this.name = "StateVersionConflict";
+	}
+};
+var StageStateMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
+		this.stage = stage;
+		this.name = "StageStateMissing";
+	}
+};
+var StateUnreadable = class extends Error {
+	stage;
+	location;
+	constructor(stage, location, cause) {
+		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
+		this.stage = stage;
+		this.location = location;
+		this.name = "StateUnreadable";
+	}
+};
+var StateSchemaTooNew = class extends Error {
+	stage;
+	schemaVersion;
+	constructor(stage, schemaVersion) {
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
+		this.stage = stage;
+		this.schemaVersion = schemaVersion;
+		this.name = "StateSchemaTooNew";
+	}
+};
+/**
+* Not thrown: emitted (once per store) when a custom `StateProvider` stands
+* in for a store, so a deploy that cannot be protected from a concurrent one
+* says so.
+*/
+var StateStoreWithoutLocking = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
+		this.provider = provider;
+		this.name = "StateStoreWithoutLocking";
+	}
+};
+var StateStoreNeedsWorkspaceName = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
+		this.provider = provider;
+		this.name = "StateStoreNeedsWorkspaceName";
+	}
+};
+var UnknownStateProvider = class extends Error {
+	config;
+	constructor(config) {
+		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
+		this.config = config;
+		this.name = "UnknownStateProvider";
+	}
+};
+/** A lock or write that could not get at the state backend in time. */
+var StateStoreBusy = class extends Error {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StateStoreBusy";
+	}
+};
+function decodeDocument(stage, body, location) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch (error) {
+		throw new StateUnreadable(stage, location, error);
+	}
+	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
+	const schemaVersion = parsed.schemaVersion;
+	if (schemaVersion === void 0) return {
+		schemaVersion: 1,
+		state: parsed
+	};
+	if (schemaVersion === 2) return {
+		schemaVersion: 2,
+		document: parsed
+	};
+	throw new StateSchemaTooNew(stage, schemaVersion);
+}
+function encodeDocument(document) {
+	return JSON.stringify(document, null, 2);
+}
+/**
+* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
+* so the first journaled deploy after an upgrade adopts them rather than
+* treating them as unknown.
+*/
+function migrateV1(stage, state) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const resources = {};
+	const seed = (type, name, id) => {
+		if (!id) return;
+		const key = name ? `${type}:${name}` : type;
+		resources[key] = {
+			key,
+			type,
+			id,
+			status: "ready",
+			updatedAt: now
+		};
+	};
+	seed("project", null, state.projectId);
+	seed("environment", null, state.environmentId);
+	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
+	seed("postgres", null, state.services?.postgresId);
+	seed("redis", null, state.services?.redisId);
+	seed("backup-destination", null, state.backups?.destinationId);
+	return {
+		schemaVersion: 2,
+		stage,
+		serial: 1,
+		state,
+		resources,
+		updatedAt: now
+	};
+}
+function newLockHolder(options) {
+	let owner = "unknown";
+	try {
+		owner = (0, node_os.userInfo)().username;
+	} catch {}
+	return {
+		id: (0, node_crypto.randomUUID)(),
+		owner,
+		host: (0, node_os.hostname)(),
+		pid: process.pid,
+		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
+		operation: options?.operation
+	};
+}
+function contentVersion(body) {
+	return (0, node_crypto.createHash)("sha256").update(body).digest("hex").slice(0, 16);
+}
+/**
+* A store over a backend that can read and conditionally write one blob per
+* stage, and create a lock object only if it does not exist. Migration and
+* resource records are the same for every such backend, so they live here.
+*/
+var DocumentStateStore = class {
+	async lock(stage, options) {
+		const holder = newLockHolder(options);
+		await this.createLock(stage, holder);
+		let released = false;
+		return {
+			stage,
+			holder,
+			release: async () => {
+				if (released) return;
+				released = true;
+				await this.removeLock(stage, holder);
+			}
+		};
+	}
+	async forceUnlock(stage) {
+		const holder = await this.readLock(stage);
+		await this.removeLock(stage, null);
+		return holder;
+	}
+	async read(stage) {
+		const current = await this.readDocument(stage);
+		if (!current) return null;
+		return {
+			state: current.document.state,
+			resources: current.document.resources,
+			version: current.version
+		};
+	}
+	async write(stage, state, options) {
+		if (options.expectedVersion === null) {
+			const document = {
+				schemaVersion: 2,
+				stage,
+				serial: 1,
+				state,
+				resources: {},
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			return this.writeRaw(stage, encodeDocument(document), null);
+		}
+		return this.mutate(stage, options.expectedVersion, (document) => ({
+			...document,
+			state
+		}));
+	}
+	async putResource(stage, record, options) {
+		return this.mutate(stage, options?.expectedVersion, (document) => ({
+			...document,
+			resources: {
+				...document.resources,
+				[record.key]: {
+					...record,
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+				}
+			}
+		}));
+	}
+	async deleteResource(stage, key, options) {
+		return this.mutate(stage, options?.expectedVersion, (document) => {
+			const { [key]: _removed, ...resources } = document.resources;
+			return {
+				...document,
+				resources
+			};
+		});
+	}
+	async mutate(stage, expectedVersion, change) {
+		const current = await this.readDocument(stage);
+		if (!current) {
+			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
+			throw new StageStateMissing(stage);
+		}
+		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
+		const next = change(current.document);
+		next.serial = current.document.serial + 1;
+		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		return this.writeRaw(stage, encodeDocument(next), current.version);
+	}
+	/**
+	* Reads the stage's document, migrating v1 in place on the way. The
+	* migration is itself a conditional write: if another run migrated (or
+	* wrote) first, its result is read instead.
+	*/
+	async readDocument(stage, attempt = 0) {
+		const raw = await this.readRaw(stage);
+		if (!raw) return null;
+		const decoded = decodeDocument(stage, raw.body, this.location(stage));
+		if (decoded.schemaVersion === 2) return {
+			document: decoded.document,
+			version: raw.version
+		};
+		await this.writeV1Backup(stage, raw.body);
+		const document = migrateV1(stage, decoded.state);
+		try {
+			return {
+				document,
+				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
+			};
+		} catch (error) {
+			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
+			throw error;
+		}
+	}
+};
+function isStateStore(value) {
+	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
+}
+/**
+* The store for a workspace's `state` config — the same config
+* `createStateProvider` reads:
+*
+* - none / `'local'`: `LocalStateStore` under `.gkm/`
+* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
+*   a stale local copy can never win over it
+* - `'s3'`: `S3StateStore`
+* - a `StateStore` object: used as is
+* - a `StateProvider` object: wrapped by `LegacyStateStore`
+*/
+async function createStateStore(options) {
+	const { config, workspaceRoot, workspaceName } = options;
+	if (!config || config.provider === "local") {
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-DDDU0HkI.cjs"));
+		return new LocalStateStore(workspaceRoot);
+	}
+	if (isStateStore(config.provider)) return config.provider;
+	if (isStateProvider(config.provider)) {
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-C_OFs1gN.cjs"));
+		return new LegacyStateStore(config.provider, { warn: options.warn });
+	}
+	if (config.provider === "ssm") {
+		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DD7jKrCO.cjs"));
+		const ssm = config;
+		return SSMStateStore.create({
+			workspaceName,
+			region: ssm.region,
+			profile: ssm.profile
+		});
+	}
+	if (config.provider === "s3") {
+		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-C7eBae0G.cjs"));
+		const s3 = config;
+		return S3StateStore.create({
+			workspaceName,
+			bucket: s3.bucket,
+			prefix: s3.prefix,
+			region: s3.region,
+			profile: s3.profile
+		});
+	}
+	throw new UnknownStateProvider(config);
+}
+/**
+* A store behind the `StateProvider` interface, for the call sites that still
+* read and write whole states (deploy, until it journals). A write is still
+* conditional on the version this provider last read.
+*/
+var StateStoreProvider = class {
+	store;
+	versions = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
+	}
+	async read(stage) {
+		const stored = await this.store.read(stage);
+		this.versions.set(stage, stored?.version ?? null);
+		return stored?.state ?? null;
+	}
+	async write(stage, state) {
+		const expectedVersion = this.versions.has(stage) ? this.versions.get(stage) ?? null : (await this.store.read(stage))?.version ?? null;
+		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		const version = await this.store.write(stage, state, { expectedVersion });
+		this.versions.set(stage, version);
+	}
+};
+//#endregion
+//#region src/deploy/state-commands.ts
+/**
+* State Management CLI Commands
+*
+* Commands for managing deployment state across local and remote providers.
+*/
+/** What `state:show` prints in place of a secret. */
+const MASKED = "********";
+/**
+* A copy of `state` with every secret replaced by `MASKED`: database
+* passwords, generated secrets and the backup IAM keys. `state:show` is run
+* to look up ids, in terminals and CI logs; nothing it prints should be
+* usable as a credential.
+*/
+function maskStateSecrets(state) {
+	const masked = structuredClone(state);
+	for (const credentials of Object.values(masked.appCredentials ?? {})) credentials.dbPassword = MASKED;
+	for (const secrets of Object.values(masked.generatedSecrets ?? {})) for (const name of Object.keys(secrets)) secrets[name] = MASKED;
+	if (masked.backups) {
+		masked.backups.iamAccessKeyId = MASKED;
+		masked.backups.iamSecretAccessKey = MASKED;
+	}
+	return masked;
+}
+/**
+* Pull state from remote to local.
+* `gkm state:pull --stage=<stage>`
+*/
+async function statePullCommand(options) {
+	const { workspace } = await require_config.loadWorkspaceConfig();
+	if (!workspace.state || workspace.state.provider === "local") {
+		console.error("No remote state provider configured.");
+		console.error("Add a remote provider in gkm.config.ts:");
+		console.error("  state: { provider: \"ssm\", region: \"us-east-1\" }");
+		process.exit(1);
+	}
+	const provider = await createStateProvider({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
 	if (!(provider instanceof CachedStateProvider)) {
 		console.error("State provider does not support pull operation.");
 		process.exit(1);
@@ -8280,19 +8981,41 @@ async function statePushCommand(options) {
 */
 async function stateShowCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const state = await (await createStateProvider({
+	const stored = await (await createStateProvider({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
 	})).read(options.stage);
-	if (!state) {
+	if (!stored) {
 		console.log(`No state found for stage: ${options.stage}`);
 		return;
 	}
+	const state = maskStateSecrets(stored);
 	if (options.json) console.log(JSON.stringify(state, null, 2));
 	else printStateDetails(state);
 }
 /**
+* Release a stage's deploy lock, whoever holds it.
+* `gkm state:unlock --stage=<stage>`
+*
+* For a run that crashed with the lock held. Releasing a lock a live run
+* holds lets a second run race it, so the holder is printed for the caller
+* to check.
+*/
+async function stateUnlockCommand(options) {
+	const { workspace } = await require_config.loadWorkspaceConfig();
+	const holder = await (await createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	})).forceUnlock(options.stage);
+	if (!holder) {
+		console.log(`Stage ${options.stage} was not locked.`);
+		return;
+	}
+	console.log(`Released the lock on stage ${options.stage}, held by ${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}.`);
+}
+/**
 * Compare local and remote state.
 * `gkm state:diff --stage=<stage>`
 */
@@ -8376,6 +9099,26 @@ function printStateDetails(state) {
 		if (state.services.postgresId) console.log(`  Postgres: ${state.services.postgresId}`);
 		if (state.services.redisId) console.log(`  Redis: ${state.services.redisId}`);
 	}
+	const credentials = Object.entries(state.appCredentials ?? {});
+	if (credentials.length > 0) {
+		console.log("");
+		console.log("Database Credentials:");
+		for (const [app, { dbUser, dbPassword }] of credentials) console.log(`  ${app}: ${dbUser} / ${dbPassword}`);
+	}
+	const generated = Object.entries(state.generatedSecrets ?? {});
+	if (generated.length > 0) {
+		console.log("");
+		console.log("Generated Secrets:");
+		for (const [app, secrets] of generated) for (const [name, value] of Object.entries(secrets)) console.log(`  ${app}.${name}: ${value}`);
+	}
+	if (state.backups) {
+		console.log("");
+		console.log("Backups:");
+		console.log(`  Bucket: ${state.backups.bucketName}`);
+		console.log(`  IAM User: ${state.backups.iamUserName}`);
+		console.log(`  IAM Access Key: ${state.backups.iamAccessKeyId}`);
+		console.log(`  IAM Secret Key: ${state.backups.iamSecretAccessKey}`);
+	}
 	if (state.dnsVerified && Object.keys(state.dnsVerified).length > 0) {
 		console.log("");
 		console.log("DNS Verified:");
@@ -8772,7 +9515,7 @@ opened.
 `;
 }
 function agentsContent(options, template) {
-	const { name, monorepo, telescope, studio, packageManager } = options;
+	const { name, monorepo, telescope, packageManager } = options;
 	const { database } = options.constructs;
 	const constructsGlob = monorepo ? WORKSPACE_CONSTRUCTS_GLOB : CONSTRUCTS_GLOB;
 	const isWorker = template.name === "worker";
@@ -8867,13 +9610,13 @@ export const config = envParser
 as \`undefined\` in exactly the environments that matter.`);
 	sections.push(conventionsSection());
 	sections.push(testingSection(database));
-	if (telescope || studio) {
-		const tools = [telescope && "**Telescope** — request and exception monitoring", studio && "**Studio** — dev dashboard and database browser"].filter(Boolean);
+	if (telescope || database) {
+		const tools = [telescope && "**Telescope** — requests, exceptions and logs as JSON at `/__telescope/api`", database && "**Database API** — `gkm dev` serves the declared database, read-only, as JSON at `/__gkm/db`"].filter(Boolean);
 		sections.push(`## Dev tools
 
 ${tools.map((t) => `- ${t}`).join("\n")}
 
-Both are derived from declared constructs. Neither needs wiring up by hand.`);
+Derived from declared constructs and served only by \`gkm dev\`: nothing to wire up by hand, and no UI — JSON for whatever tool you point at it.`);
 	}
 	sections.push(`## Before you say it works
 
@@ -9316,11 +10059,7 @@ const TOOLCHAIN_VERSIONS = {
 	esbuild: "~0.28.2",
 	vitest: "~5.0.2",
 	vite: "~8.3.1",
-	"@vitejs/plugin-react": "^6.1.1",
-	storybook: "^10.6.0",
-	"@storybook/addon-docs": "^10.6.0",
-	"@storybook/addon-a11y": "^10.6.0",
-	"@storybook/react-vite": "^10.6.0"
+	"@vitejs/plugin-react": "^6.1.1"
 };
 /**
 * The Expo app's packages, which track an Expo SDK release (57) rather than
@@ -9380,26 +10119,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.54",
-	"@geekmidas/auth": "~10.0.0-alpha.54",
-	"@geekmidas/cache": "~10.0.0-alpha.54",
-	"@geekmidas/client": "~10.0.0-alpha.54",
-	"@geekmidas/cloud": "~10.0.0-alpha.54",
-	"@geekmidas/constructs": "~10.0.0-alpha.54",
-	"@geekmidas/db": "~10.0.0-alpha.54",
-	"@geekmidas/emailkit": "~10.0.0-alpha.54",
-	"@geekmidas/envkit": "~10.0.0-alpha.54",
-	"@geekmidas/errors": "~10.0.0-alpha.54",
-	"@geekmidas/events": "~10.0.0-alpha.54",
-	"@geekmidas/logger": "~10.0.0-alpha.54",
-	"@geekmidas/manifest": "~10.0.0-alpha.54",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.54",
-	"@geekmidas/schema": "~10.0.0-alpha.54",
-	"@geekmidas/services": "~10.0.0-alpha.54",
-	"@geekmidas/storage": "~10.0.0-alpha.54",
-	"@geekmidas/studio": "~10.0.0-alpha.54",
-	"@geekmidas/telescope": "~10.0.0-alpha.54",
-	"@geekmidas/testkit": "~10.0.0-alpha.54",
+	"@geekmidas/audit": "~10.0.0-alpha.56",
+	"@geekmidas/auth": "~10.0.0-alpha.56",
+	"@geekmidas/cache": "~10.0.0-alpha.56",
+	"@geekmidas/client": "~10.0.0-alpha.56",
+	"@geekmidas/cloud": "~10.0.0-alpha.56",
+	"@geekmidas/constructs": "~10.0.0-alpha.56",
+	"@geekmidas/db": "~10.0.0-alpha.56",
+	"@geekmidas/emailkit": "~10.0.0-alpha.56",
+	"@geekmidas/envkit": "~10.0.0-alpha.56",
+	"@geekmidas/errors": "~10.0.0-alpha.56",
+	"@geekmidas/events": "~10.0.0-alpha.56",
+	"@geekmidas/logger": "~10.0.0-alpha.56",
+	"@geekmidas/manifest": "~10.0.0-alpha.56",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.56",
+	"@geekmidas/schema": "~10.0.0-alpha.56",
+	"@geekmidas/services": "~10.0.0-alpha.56",
+	"@geekmidas/storage": "~10.0.0-alpha.56",
+	"@geekmidas/telescope": "~10.0.0-alpha.56",
+	"@geekmidas/testkit": "~10.0.0-alpha.56",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -9522,14 +10260,13 @@ export default defineConfig({
 * Generate configuration files (gkm.config.ts, tsconfig.json, biome.json, turbo.json)
 */
 function generateConfigFiles(options, template) {
-	const { telescope, studio, routesStructure } = options;
+	const { telescope, routesStructure } = options;
 	const isServerless = template.name === "serverless";
 	const hasWorker = template.name === "worker";
 	const isFullstack = options.template === "fullstack";
 	const getRoutesGlob = () => routesGlob(routesStructure);
 	if (isFullstack) return generateSingleAppConfigFiles(options, template, {
 		telescope,
-		studio,
 		routesStructure,
 		isServerless,
 		hasWorker,
@@ -9555,8 +10292,6 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
     enabled: true,
     path: '/__telescope',
   },`;
-	if (studio) gkmConfig += `
-  studio: './src/config/studio#studio',`;
 	gkmConfig += `
   openapi: {
     enabled: true,
@@ -11105,7 +11840,6 @@ function generateMonorepoFiles(options, _template) {
 			lint: "biome lint .",
 			fmt: "biome format . --write",
 			"fmt:check": "biome format .",
-			...isFullstack ? { storybook: "pnpm --filter ./packages/ui storybook" } : {},
 			...deploy.scripts
 		},
 		dependencies: {
@@ -11646,14 +12380,13 @@ export const cache = new Cache('${kv.id}');
 * Generate package.json with dependencies based on template and options
 */
 function generatePackageJson(options, template) {
-	const { name, telescope, studio, monorepo } = options;
+	const { name, telescope, monorepo } = options;
 	const { database, cache, uploads, mail } = options.constructs;
 	const dependencies = { ...template.dependencies };
 	const devDependencies = { ...template.devDependencies };
 	const scripts = { ...template.scripts };
 	if (options.loggerType === "pino") dependencies.pino = DEPENDENCY_VERSIONS.pino;
 	if (telescope) dependencies["@geekmidas/telescope"] = GEEKMIDAS_VERSIONS["@geekmidas/telescope"];
-	if (studio) dependencies["@geekmidas/studio"] = GEEKMIDAS_VERSIONS["@geekmidas/studio"];
 	const declares = !monorepo;
 	if (declares && (database || uploads || cache || mail)) dependencies["@geekmidas/manifest"] = GEEKMIDAS_VERSIONS["@geekmidas/manifest"];
 	if (declares && uploads) dependencies["@geekmidas/storage"] = GEEKMIDAS_VERSIONS["@geekmidas/storage"];
@@ -11794,158 +12527,33 @@ export type Factory = ReturnType<typeof createFactory>;
 	}];
 }
 //#endregion
-//#region src/init/generators/ui.ts
+//#region src/init/generators/shadcn.ts
 /**
-* Generate UI package files for fullstack template
-* Based on @geekmidas/ui with shadcn/ui, Tailwind CSS v4, and Storybook
-*/
-function generateUiPackageFiles(options) {
-	if (!options.monorepo || options.template !== "fullstack") return [];
-	const packageJson = {
-		name: `@${options.name}/ui`,
-		version: "0.0.1",
-		private: true,
-		type: "module",
-		exports: {
-			".": "./src/index.ts",
-			"./components": "./src/components/index.ts",
-			"./lib/utils": "./src/lib/utils.ts",
-			"./styles": "./src/styles/globals.css"
-		},
-		scripts: {
-			"ts:check": "tsc --noEmit",
-			storybook: "storybook dev -p 6006",
-			"build:storybook": "storybook build -o dist/storybook"
-		},
-		dependencies: {
-			"@radix-ui/react-dialog": DEPENDENCY_VERSIONS["@radix-ui/react-dialog"],
-			"@radix-ui/react-label": DEPENDENCY_VERSIONS["@radix-ui/react-label"],
-			"@radix-ui/react-separator": DEPENDENCY_VERSIONS["@radix-ui/react-separator"],
-			"@radix-ui/react-slot": DEPENDENCY_VERSIONS["@radix-ui/react-slot"],
-			"@radix-ui/react-tabs": DEPENDENCY_VERSIONS["@radix-ui/react-tabs"],
-			"@radix-ui/react-tooltip": DEPENDENCY_VERSIONS["@radix-ui/react-tooltip"],
-			"class-variance-authority": DEPENDENCY_VERSIONS["class-variance-authority"],
-			clsx: DEPENDENCY_VERSIONS["clsx"],
-			"lucide-react": DEPENDENCY_VERSIONS["lucide-react"],
-			"tailwind-merge": DEPENDENCY_VERSIONS["tailwind-merge"]
-		},
-		devDependencies: {
-			"@storybook/addon-a11y": TOOLCHAIN_VERSIONS["@storybook/addon-a11y"],
-			"@storybook/addon-docs": TOOLCHAIN_VERSIONS["@storybook/addon-docs"],
-			"@storybook/react-vite": TOOLCHAIN_VERSIONS["@storybook/react-vite"],
-			"@tailwindcss/vite": DEPENDENCY_VERSIONS["@tailwindcss/vite"],
-			"@types/react": DEPENDENCY_VERSIONS["@types/react"],
-			"@types/react-dom": DEPENDENCY_VERSIONS["@types/react-dom"],
-			react: DEPENDENCY_VERSIONS["react"],
-			"react-dom": DEPENDENCY_VERSIONS["react-dom"],
-			storybook: TOOLCHAIN_VERSIONS["storybook"],
-			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
-			typescript: TOOLCHAIN_VERSIONS["typescript"],
-			vite: TOOLCHAIN_VERSIONS["vite"]
-		},
-		peerDependencies: {
-			react: ">=18.0.0",
-			"react-dom": ">=18.0.0",
-			tailwindcss: ">=4.0.0"
-		}
-	};
-	const tsConfig = {
-		extends: "../../tsconfig.json",
-		compilerOptions: {
-			jsx: "react-jsx",
-			lib: [
-				"ES2023",
-				"DOM",
-				"DOM.Iterable"
-			],
-			noEmit: true,
-			allowImportingTsExtensions: true,
-			paths: { "~/*": ["./src/*"] }
-		},
-		include: ["src/**/*"],
-		exclude: [
-			"node_modules",
-			"dist",
-			"**/*.stories.tsx"
-		]
-	};
-	const componentsJson = {
-		$schema: "https://ui.shadcn.com/schema.json",
-		style: "new-york",
-		rsc: false,
-		tsx: true,
-		tailwind: {
-			config: "",
-			css: "src/styles/globals.css",
-			baseColor: "neutral",
-			cssVariables: true,
-			prefix: ""
-		},
-		aliases: {
-			components: "~/components",
-			utils: "~/lib/utils",
-			ui: "~/components/ui",
-			lib: "~/lib",
-			hooks: "~/hooks"
-		},
-		iconLibrary: "lucide"
-	};
-	const storybookMain = `import type { StorybookConfig } from '@storybook/react-vite';
-
-const config: StorybookConfig = {
-  stories: ['../src/**/*.stories.@(ts|tsx)'],
-  // Controls, actions, backgrounds, viewport and interactions are part of
-  // \`storybook\` itself; docs and a11y are add-ons.
-  addons: ['@storybook/addon-docs', '@storybook/addon-a11y'],
-  framework: {
-    name: '@storybook/react-vite',
-    options: {},
-  },
-  // \`react-docgen\` parses components itself. The TypeScript-based docgen
-  // calls into TypeScript's JavaScript API, which TypeScript 7 no longer ships.
-  typescript: {
-    reactDocgen: 'react-docgen',
-  },
-  viteFinal: async (config) => {
-    // Add Tailwind CSS v4 plugin
-    const tailwindcss = await import('@tailwindcss/vite');
-    config.plugins = config.plugins || [];
-    config.plugins.push(tailwindcss.default());
-    return config;
-  },
-};
-
-export default config;
-`;
-	const storybookPreview = `import type { Preview } from '@storybook/react-vite';
-import '../src/styles/globals.css';
-
-const preview: Preview = {
-  // The starting background is a global, not a parameter.
-  initialGlobals: {
-    backgrounds: { value: 'dark' },
-  },
-  parameters: {
-    backgrounds: {
-      options: {
-        dark: { name: 'dark', value: '#171717' },
-        surface: { name: 'surface', value: '#1c1c1c' },
-        light: { name: 'light', value: '#fafafa' },
-      },
-    },
-    controls: {
-      matchers: {
-        color: /(background|color)$/i,
-        date: /Date$/i,
-      },
-    },
-    layout: 'centered',
-  },
+* shadcn/ui components, written into the web app that uses them.
+*
+* shadcn is copy-in by design: the components are the app's own source, to
+* edit and add to with `npx shadcn@latest add`. A shared workspace package of
+* them was one more package to build and version for code only the web app
+* imported.
+*/
+/** What the components below import. */
+const SHADCN_DEPENDENCIES = {
+	"@radix-ui/react-dialog": DEPENDENCY_VERSIONS["@radix-ui/react-dialog"],
+	"@radix-ui/react-label": DEPENDENCY_VERSIONS["@radix-ui/react-label"],
+	"@radix-ui/react-separator": DEPENDENCY_VERSIONS["@radix-ui/react-separator"],
+	"@radix-ui/react-slot": DEPENDENCY_VERSIONS["@radix-ui/react-slot"],
+	"@radix-ui/react-tabs": DEPENDENCY_VERSIONS["@radix-ui/react-tabs"],
+	"@radix-ui/react-tooltip": DEPENDENCY_VERSIONS["@radix-ui/react-tooltip"],
+	"class-variance-authority": DEPENDENCY_VERSIONS["class-variance-authority"],
+	clsx: DEPENDENCY_VERSIONS["clsx"],
+	"lucide-react": DEPENDENCY_VERSIONS["lucide-react"],
+	"tailwind-merge": DEPENDENCY_VERSIONS["tailwind-merge"]
 };
-
-export default preview;
-`;
-	const globalsCss = `@import "tailwindcss";
+/**
+* Tailwind v4 with the shadcn theme tokens — the stylesheet the app imports
+* once, at its root.
+*/
+const SHADCN_GLOBALS_CSS = `@import "tailwindcss";
 
 @theme {
   --color-background: hsl(var(--background));
@@ -12029,14 +12637,56 @@ export default preview;
   }
 }
 `;
-	const utilsTs = `import { type ClassValue, clsx } from 'clsx';
+/**
+* The components, `cn`, and the `components.json` that tells the shadcn CLI
+* where they live.
+*
+* @param appDir the web app, relative to the workspace root (`apps/web`)
+* @param css the stylesheet holding {@link SHADCN_GLOBALS_CSS}, relative to
+*   the app
+* @param options.rsc whether the app renders React Server Components, so
+*   `shadcn add` marks what it writes `'use client'`. The radix-based
+*   components here carry the directive either way; outside RSC it is inert.
+*/
+function shadcnFiles(appDir, css, options) {
+	const componentsJson = {
+		$schema: "https://ui.shadcn.com/schema.json",
+		style: "new-york",
+		rsc: options.rsc,
+		tsx: true,
+		tailwind: {
+			config: "",
+			css,
+			baseColor: "neutral",
+			cssVariables: true,
+			prefix: ""
+		},
+		aliases: {
+			components: "~/components",
+			utils: "~/lib/utils",
+			ui: "~/components/ui",
+			lib: "~/lib",
+			hooks: "~/hooks"
+		},
+		iconLibrary: "lucide"
+	};
+	return [
+		{
+			path: `${appDir}/components.json`,
+			content: `${JSON.stringify(componentsJson, null, 2)}\n`
+		},
+		{
+			path: `${appDir}/src/lib/utils.ts`,
+			content: `import { type ClassValue, clsx } from 'clsx';
 import { twMerge } from 'tailwind-merge';
 
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs));
 }
-`;
-	const buttonTsx = `import { Slot } from '@radix-ui/react-slot';
+`
+		},
+		...Object.entries({
+			button: `import { Slot } from '@radix-ui/react-slot';
 import { cva, type VariantProps } from 'class-variance-authority';
 import * as React from 'react';
 
@@ -12093,73 +12743,8 @@ const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
 Button.displayName = 'Button';
 
 export { Button, buttonVariants };
-`;
-	const buttonStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Button } from '~/components/ui/button';
-
-const meta: Meta<typeof Button> = {
-  title: 'Components/Button',
-  component: Button,
-  tags: ['autodocs'],
-  argTypes: {
-    variant: {
-      control: 'select',
-      options: ['default', 'destructive', 'outline', 'secondary', 'ghost', 'link'],
-    },
-    size: {
-      control: 'select',
-      options: ['default', 'sm', 'lg', 'icon'],
-    },
-  },
-};
-
-export default meta;
-type Story = StoryObj<typeof Button>;
-
-export const Default: Story = {
-  args: {
-    children: 'Button',
-    variant: 'default',
-    size: 'default',
-  },
-};
-
-export const Secondary: Story = {
-  args: {
-    children: 'Secondary',
-    variant: 'secondary',
-  },
-};
-
-export const Destructive: Story = {
-  args: {
-    children: 'Destructive',
-    variant: 'destructive',
-  },
-};
-
-export const Outline: Story = {
-  args: {
-    children: 'Outline',
-    variant: 'outline',
-  },
-};
-
-export const Ghost: Story = {
-  args: {
-    children: 'Ghost',
-    variant: 'ghost',
-  },
-};
-
-export const Link: Story = {
-  args: {
-    children: 'Link',
-    variant: 'link',
-  },
-};
-`;
-	const inputTsx = `import * as React from 'react';
+`,
+			input: `import * as React from 'react';
 
 import { cn } from '~/lib/utils';
 
@@ -12181,8 +12766,8 @@ const Input = React.forwardRef<HTMLInputElement, React.ComponentProps<'input'>>(
 Input.displayName = 'Input';
 
 export { Input };
-`;
-	const cardTsx = `import * as React from 'react';
+`,
+			card: `import * as React from 'react';
 
 import { cn } from '~/lib/utils';
 
@@ -12258,124 +12843,10 @@ const CardFooter = React.forwardRef<
 CardFooter.displayName = 'CardFooter';
 
 export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };
-`;
-	const inputStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Input } from '~/components/ui/input';
-
-const meta: Meta<typeof Input> = {
-  title: 'Components/Input',
-  component: Input,
-  tags: ['autodocs'],
-  argTypes: {
-    type: {
-      control: 'select',
-      options: ['text', 'email', 'password', 'number', 'search', 'tel', 'url'],
-    },
-    disabled: {
-      control: 'boolean',
-    },
-  },
-};
-
-export default meta;
-type Story = StoryObj<typeof Input>;
-
-export const Default: Story = {
-  args: {
-    placeholder: 'Enter text...',
-  },
-};
-
-export const Email: Story = {
-  args: {
-    type: 'email',
-    placeholder: 'Enter email...',
-  },
-};
-
-export const Password: Story = {
-  args: {
-    type: 'password',
-    placeholder: 'Enter password...',
-  },
-};
-
-export const Disabled: Story = {
-  args: {
-    placeholder: 'Disabled input',
-    disabled: true,
-  },
-};
-
-export const WithValue: Story = {
-  args: {
-    defaultValue: 'Hello World',
-  },
-};
-`;
-	const cardStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Button } from '~/components/ui/button';
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from '~/components/ui/card';
-import { Input } from '~/components/ui/input';
-
-const meta: Meta<typeof Card> = {
-  title: 'Components/Card',
-  component: Card,
-  tags: ['autodocs'],
-};
-
-export default meta;
-type Story = StoryObj<typeof Card>;
-
-export const Default: Story = {
-  render: () => (
-    <Card className="w-[350px]">
-      <CardHeader>
-        <CardTitle>Card Title</CardTitle>
-        <CardDescription>Card description goes here.</CardDescription>
-      </CardHeader>
-      <CardContent>
-        <p>Card content goes here.</p>
-      </CardContent>
-    </Card>
-  ),
-};
-
-export const WithFooter: Story = {
-  render: () => (
-    <Card className="w-[350px]">
-      <CardHeader>
-        <CardTitle>Create Account</CardTitle>
-        <CardDescription>Enter your details below.</CardDescription>
-      </CardHeader>
-      <CardContent className="space-y-4">
-        <Input placeholder="Email" type="email" />
-        <Input placeholder="Password" type="password" />
-      </CardContent>
-      <CardFooter className="flex justify-between">
-        <Button variant="outline">Cancel</Button>
-        <Button>Create</Button>
-      </CardFooter>
-    </Card>
-  ),
-};
+`,
+			label: `'use client';
 
-export const Simple: Story = {
-  render: () => (
-    <Card className="w-[350px] p-6">
-      <p>Simple card with just content.</p>
-    </Card>
-  ),
-};
-`;
-	const labelTsx = `import * as LabelPrimitive from '@radix-ui/react-label';
+import * as LabelPrimitive from '@radix-ui/react-label';
 import { cva, type VariantProps } from 'class-variance-authority';
 import * as React from 'react';
 
@@ -12399,47 +12870,8 @@ const Label = React.forwardRef<
 Label.displayName = LabelPrimitive.Root.displayName;
 
 export { Label };
-`;
-	const labelStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Input } from '~/components/ui/input';
-import { Label } from '~/components/ui/label';
-
-const meta: Meta<typeof Label> = {
-  title: 'Components/Label',
-  component: Label,
-  tags: ['autodocs'],
-};
-
-export default meta;
-type Story = StoryObj<typeof Label>;
-
-export const Default: Story = {
-  args: {
-    children: 'Label',
-  },
-};
-
-export const WithInput: Story = {
-  render: () => (
-    <div className="grid w-full max-w-sm items-center gap-1.5">
-      <Label htmlFor="email">Email</Label>
-      <Input type="email" id="email" placeholder="Email" />
-    </div>
-  ),
-};
-
-export const Disabled: Story = {
-  render: () => (
-    <div className="grid w-full max-w-sm items-center gap-1.5">
-      <Label htmlFor="disabled" className="peer-disabled:cursor-not-allowed peer-disabled:opacity-70">
-        Disabled
-      </Label>
-      <Input type="text" id="disabled" placeholder="Disabled" disabled className="peer" />
-    </div>
-  ),
-};
-`;
-	const badgeTsx = `import { cva, type VariantProps } from 'class-variance-authority';
+`,
+			badge: `import { cva, type VariantProps } from 'class-variance-authority';
 import * as React from 'react';
 
 import { cn } from '~/lib/utils';
@@ -12475,54 +12907,10 @@ function Badge({ className, variant, ...props }: BadgeProps) {
 }
 
 export { Badge, badgeVariants };
-`;
-	const badgeStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Badge } from '~/components/ui/badge';
-
-const meta: Meta<typeof Badge> = {
-  title: 'Components/Badge',
-  component: Badge,
-  tags: ['autodocs'],
-  argTypes: {
-    variant: {
-      control: 'select',
-      options: ['default', 'secondary', 'destructive', 'outline'],
-    },
-  },
-};
-
-export default meta;
-type Story = StoryObj<typeof Badge>;
-
-export const Default: Story = {
-  args: {
-    children: 'Badge',
-    variant: 'default',
-  },
-};
-
-export const Secondary: Story = {
-  args: {
-    children: 'Secondary',
-    variant: 'secondary',
-  },
-};
-
-export const Destructive: Story = {
-  args: {
-    children: 'Destructive',
-    variant: 'destructive',
-  },
-};
+`,
+			separator: `'use client';
 
-export const Outline: Story = {
-  args: {
-    children: 'Outline',
-    variant: 'outline',
-  },
-};
-`;
-	const separatorTsx = `import * as SeparatorPrimitive from '@radix-ui/react-separator';
+import * as SeparatorPrimitive from '@radix-ui/react-separator';
 import * as React from 'react';
 
 import { cn } from '~/lib/utils';
@@ -12551,59 +12939,10 @@ const Separator = React.forwardRef<
 Separator.displayName = SeparatorPrimitive.Root.displayName;
 
 export { Separator };
-`;
-	const separatorStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Separator } from '~/components/ui/separator';
-
-const meta: Meta<typeof Separator> = {
-  title: 'Components/Separator',
-  component: Separator,
-  tags: ['autodocs'],
-  argTypes: {
-    orientation: {
-      control: 'select',
-      options: ['horizontal', 'vertical'],
-    },
-  },
-};
-
-export default meta;
-type Story = StoryObj<typeof Separator>;
-
-export const Horizontal: Story = {
-  render: () => (
-    <div className="w-[300px]">
-      <div className="space-y-1">
-        <h4 className="text-sm font-medium leading-none">Radix Primitives</h4>
-        <p className="text-sm text-muted-foreground">
-          An open-source UI component library.
-        </p>
-      </div>
-      <Separator className="my-4" />
-      <div className="flex h-5 items-center space-x-4 text-sm">
-        <div>Blog</div>
-        <Separator orientation="vertical" />
-        <div>Docs</div>
-        <Separator orientation="vertical" />
-        <div>Source</div>
-      </div>
-    </div>
-  ),
-};
+`,
+			tabs: `'use client';
 
-export const Vertical: Story = {
-  render: () => (
-    <div className="flex h-5 items-center space-x-4 text-sm">
-      <div>Blog</div>
-      <Separator orientation="vertical" />
-      <div>Docs</div>
-      <Separator orientation="vertical" />
-      <div>Source</div>
-    </div>
-  ),
-};
-`;
-	const tabsTsx = `import * as TabsPrimitive from '@radix-ui/react-tabs';
+import * as TabsPrimitive from '@radix-ui/react-tabs';
 import * as React from 'react';
 
 import { cn } from '~/lib/utils';
@@ -12656,81 +12995,10 @@ const TabsContent = React.forwardRef<
 TabsContent.displayName = TabsPrimitive.Content.displayName;
 
 export { Tabs, TabsList, TabsTrigger, TabsContent };
-`;
-	const tabsStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
-import { Button } from '~/components/ui/button';
-import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from '~/components/ui/card';
-import { Input } from '~/components/ui/input';
-import { Label } from '~/components/ui/label';
-
-const meta: Meta<typeof Tabs> = {
-  title: 'Components/Tabs',
-  component: Tabs,
-  tags: ['autodocs'],
-};
+`,
+			tooltip: `'use client';
 
-export default meta;
-type Story = StoryObj<typeof Tabs>;
-
-export const Default: Story = {
-  render: () => (
-    <Tabs defaultValue="account" className="w-[400px]">
-      <TabsList>
-        <TabsTrigger value="account">Account</TabsTrigger>
-        <TabsTrigger value="password">Password</TabsTrigger>
-      </TabsList>
-      <TabsContent value="account">
-        <Card>
-          <CardHeader>
-            <CardTitle>Account</CardTitle>
-            <CardDescription>
-              Make changes to your account here. Click save when you're done.
-            </CardDescription>
-          </CardHeader>
-          <CardContent className="space-y-2">
-            <div className="space-y-1">
-              <Label htmlFor="name">Name</Label>
-              <Input id="name" defaultValue="Pedro Duarte" />
-            </div>
-            <div className="space-y-1">
-              <Label htmlFor="username">Username</Label>
-              <Input id="username" defaultValue="@peduarte" />
-            </div>
-          </CardContent>
-          <CardFooter>
-            <Button>Save changes</Button>
-          </CardFooter>
-        </Card>
-      </TabsContent>
-      <TabsContent value="password">
-        <Card>
-          <CardHeader>
-            <CardTitle>Password</CardTitle>
-            <CardDescription>
-              Change your password here. After saving, you'll be logged out.
-            </CardDescription>
-          </CardHeader>
-          <CardContent className="space-y-2">
-            <div className="space-y-1">
-              <Label htmlFor="current">Current password</Label>
-              <Input id="current" type="password" />
-            </div>
-            <div className="space-y-1">
-              <Label htmlFor="new">New password</Label>
-              <Input id="new" type="password" />
-            </div>
-          </CardContent>
-          <CardFooter>
-            <Button>Save password</Button>
-          </CardFooter>
-        </Card>
-      </TabsContent>
-    </Tabs>
-  ),
-};
-`;
-	const tooltipTsx = `import * as TooltipPrimitive from '@radix-ui/react-tooltip';
+import * as TooltipPrimitive from '@radix-ui/react-tooltip';
 import * as React from 'react';
 
 import { cn } from '~/lib/utils';
@@ -12760,80 +13028,10 @@ const TooltipContent = React.forwardRef<
 TooltipContent.displayName = TooltipPrimitive.Content.displayName;
 
 export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };
-`;
-	const tooltipStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '~/components/ui/tooltip';
-import { Button } from '~/components/ui/button';
-
-const meta: Meta<typeof Tooltip> = {
-  title: 'Components/Tooltip',
-  component: Tooltip,
-  tags: ['autodocs'],
-  decorators: [
-    (Story) => (
-      <TooltipProvider>
-        <Story />
-      </TooltipProvider>
-    ),
-  ],
-};
-
-export default meta;
-type Story = StoryObj<typeof Tooltip>;
-
-export const Default: Story = {
-  render: () => (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <Button variant="outline">Hover me</Button>
-      </TooltipTrigger>
-      <TooltipContent>
-        <p>Add to library</p>
-      </TooltipContent>
-    </Tooltip>
-  ),
-};
+`,
+			dialog: `'use client';
 
-export const Positions: Story = {
-  render: () => (
-    <div className="flex gap-4">
-      <Tooltip>
-        <TooltipTrigger asChild>
-          <Button variant="outline">Top</Button>
-        </TooltipTrigger>
-        <TooltipContent side="top">
-          <p>Top tooltip</p>
-        </TooltipContent>
-      </Tooltip>
-      <Tooltip>
-        <TooltipTrigger asChild>
-          <Button variant="outline">Bottom</Button>
-        </TooltipTrigger>
-        <TooltipContent side="bottom">
-          <p>Bottom tooltip</p>
-        </TooltipContent>
-      </Tooltip>
-      <Tooltip>
-        <TooltipTrigger asChild>
-          <Button variant="outline">Left</Button>
-        </TooltipTrigger>
-        <TooltipContent side="left">
-          <p>Left tooltip</p>
-        </TooltipContent>
-      </Tooltip>
-      <Tooltip>
-        <TooltipTrigger asChild>
-          <Button variant="outline">Right</Button>
-        </TooltipTrigger>
-        <TooltipContent side="right">
-          <p>Right tooltip</p>
-        </TooltipContent>
-      </Tooltip>
-    </div>
-  ),
-};
-`;
-	const dialogTsx = `import * as DialogPrimitive from '@radix-ui/react-dialog';
+import * as DialogPrimitive from '@radix-ui/react-dialog';
 import { X } from 'lucide-react';
 import * as React from 'react';
 
@@ -12953,255 +13151,11 @@ export {
   DialogTitle,
   DialogDescription,
 };
-`;
-	const dialogStories = `import type { Meta, StoryObj } from '@storybook/react-vite';
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-  DialogTrigger,
-} from '~/components/ui/dialog';
-import { Button } from '~/components/ui/button';
-import { Input } from '~/components/ui/input';
-import { Label } from '~/components/ui/label';
-
-const meta: Meta<typeof Dialog> = {
-  title: 'Components/Dialog',
-  component: Dialog,
-  tags: ['autodocs'],
-};
-
-export default meta;
-type Story = StoryObj<typeof Dialog>;
-
-export const Default: Story = {
-  render: () => (
-    <Dialog>
-      <DialogTrigger asChild>
-        <Button variant="outline">Edit Profile</Button>
-      </DialogTrigger>
-      <DialogContent className="sm:max-w-[425px]">
-        <DialogHeader>
-          <DialogTitle>Edit profile</DialogTitle>
-          <DialogDescription>
-            Make changes to your profile here. Click save when you're done.
-          </DialogDescription>
-        </DialogHeader>
-        <div className="grid gap-4 py-4">
-          <div className="grid grid-cols-4 items-center gap-4">
-            <Label htmlFor="name" className="text-right">
-              Name
-            </Label>
-            <Input id="name" defaultValue="Pedro Duarte" className="col-span-3" />
-          </div>
-          <div className="grid grid-cols-4 items-center gap-4">
-            <Label htmlFor="username" className="text-right">
-              Username
-            </Label>
-            <Input id="username" defaultValue="@peduarte" className="col-span-3" />
-          </div>
-        </div>
-        <DialogFooter>
-          <Button type="submit">Save changes</Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  ),
-};
-
-export const Alert: Story = {
-  render: () => (
-    <Dialog>
-      <DialogTrigger asChild>
-        <Button variant="destructive">Delete Account</Button>
-      </DialogTrigger>
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Are you absolutely sure?</DialogTitle>
-          <DialogDescription>
-            This action cannot be undone. This will permanently delete your
-            account and remove your data from our servers.
-          </DialogDescription>
-        </DialogHeader>
-        <DialogFooter>
-          <Button variant="outline">Cancel</Button>
-          <Button variant="destructive">Delete</Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  ),
-};
-`;
-	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button/index.tsx';
-export { Input } from './input/index.tsx';
-export {
-  Card,
-  CardHeader,
-  CardFooter,
-  CardTitle,
-  CardDescription,
-  CardContent,
-} from './card/index.tsx';
-export { Label } from './label/index.tsx';
-export { Badge, type BadgeProps, badgeVariants } from './badge/index.tsx';
-export { Separator } from './separator/index.tsx';
-export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs/index.tsx';
-export {
-  Tooltip,
-  TooltipTrigger,
-  TooltipContent,
-  TooltipProvider,
-} from './tooltip/index.tsx';
-export {
-  Dialog,
-  DialogPortal,
-  DialogOverlay,
-  DialogTrigger,
-  DialogClose,
-  DialogContent,
-  DialogHeader,
-  DialogFooter,
-  DialogTitle,
-  DialogDescription,
-} from './dialog/index.tsx';
-`;
-	const buttonIndexTsx = buttonTsx;
-	const inputIndexTsx = inputTsx;
-	const cardIndexTsx = cardTsx;
-	const componentsIndex = `export * from './ui/index.ts';
-`;
-	const indexTs = `// @${options.name}/ui - Shared UI component library
-
-// shadcn/ui components
-export * from './components/index.ts';
-
-// Utilities
-export { cn } from './lib/utils.ts';
-`;
-	return [
-		{
-			path: "packages/ui/package.json",
-			content: `${JSON.stringify(packageJson, null, 2)}\n`
-		},
-		{
-			path: "packages/ui/tsconfig.json",
-			content: `${JSON.stringify(tsConfig, null, 2)}\n`
-		},
-		{
-			path: "packages/ui/components.json",
-			content: `${JSON.stringify(componentsJson, null, 2)}\n`
-		},
-		{
-			path: "packages/ui/.storybook/main.ts",
-			content: storybookMain
-		},
-		{
-			path: "packages/ui/.storybook/preview.ts",
-			content: storybookPreview
-		},
-		{
-			path: "packages/ui/src/styles/globals.css",
-			content: globalsCss
-		},
-		{
-			path: "packages/ui/src/lib/utils.ts",
-			content: utilsTs
-		},
-		{
-			path: "packages/ui/src/components/ui/button/index.tsx",
-			content: buttonIndexTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/button/button.stories.tsx",
-			content: buttonStories
-		},
-		{
-			path: "packages/ui/src/components/ui/input/index.tsx",
-			content: inputIndexTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/input/input.stories.tsx",
-			content: inputStories
-		},
-		{
-			path: "packages/ui/src/components/ui/card/index.tsx",
-			content: cardIndexTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/card/card.stories.tsx",
-			content: cardStories
-		},
-		{
-			path: "packages/ui/src/components/ui/label/index.tsx",
-			content: labelTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/label/label.stories.tsx",
-			content: labelStories
-		},
-		{
-			path: "packages/ui/src/components/ui/badge/index.tsx",
-			content: badgeTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/badge/badge.stories.tsx",
-			content: badgeStories
-		},
-		{
-			path: "packages/ui/src/components/ui/separator/index.tsx",
-			content: separatorTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/separator/separator.stories.tsx",
-			content: separatorStories
-		},
-		{
-			path: "packages/ui/src/components/ui/tabs/index.tsx",
-			content: tabsTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/tabs/tabs.stories.tsx",
-			content: tabsStories
-		},
-		{
-			path: "packages/ui/src/components/ui/tooltip/index.tsx",
-			content: tooltipTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/tooltip/tooltip.stories.tsx",
-			content: tooltipStories
-		},
-		{
-			path: "packages/ui/src/components/ui/dialog/index.tsx",
-			content: dialogTsx
-		},
-		{
-			path: "packages/ui/src/components/ui/dialog/dialog.stories.tsx",
-			content: dialogStories
-		},
-		{
-			path: "packages/ui/src/components/ui/index.ts",
-			content: componentsUiIndex
-		},
-		{
-			path: "packages/ui/src/components/index.ts",
-			content: componentsIndex
-		},
-		{
-			path: "packages/ui/src/index.ts",
-			content: indexTs
-		},
-		{
-			path: "packages/ui/.gitignore",
-			content: `node_modules/
-dist/
-storybook-static/
-*.log
 `
-		}
+		}).map(([name, content]) => ({
+			path: `${appDir}/src/components/ui/${name}.tsx`,
+			content
+		}))
 	];
 }
 //#endregion
@@ -13213,7 +13167,6 @@ function generateWebAppFiles(options) {
 	if (!options.monorepo || options.template !== "fullstack") return [];
 	const packageName = `@${options.name}/web`;
 	const modelsPackage = `@${options.name}/models`;
-	const uiPackage = `@${options.name}/ui`;
 	const packageJson = {
 		name: packageName,
 		version: "0.0.1",
@@ -13227,7 +13180,7 @@ function generateWebAppFiles(options) {
 		},
 		dependencies: {
 			[modelsPackage]: "workspace:*",
-			[uiPackage]: "workspace:*",
+			...SHADCN_DEPENDENCIES,
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
@@ -13252,7 +13205,7 @@ function generateWebAppFiles(options) {
 const nextConfig: NextConfig = {
   output: 'standalone',
   reactStrictMode: true,
-  transpilePackages: ['${modelsPackage}', '${uiPackage}'],
+  transpilePackages: ['${modelsPackage}'],
 };
 
 export default nextConfig;
@@ -13285,12 +13238,10 @@ export default nextConfig;
 			incremental: true,
 			plugins: [{ name: "next" }],
 			paths: {
-				"~/*": ["./src/*", "../../packages/ui/src/*"],
+				"~/*": ["./src/*"],
 				[`@${options.name}/client/*`]: ["../../.gkm/client/*"],
 				[`${modelsPackage}`]: ["../../packages/models/src"],
-				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
-				[`${uiPackage}`]: ["../../packages/ui/src"],
-				[`${uiPackage}/*`]: ["../../packages/ui/src/*"]
+				[`${modelsPackage}/*`]: ["../../packages/models/src/*"]
 			}
 		},
 		include: [
@@ -13386,8 +13337,6 @@ export const api = createApi({
   baseURL: clientConfig.apiUrl,
   queryClient: getQueryClient(),
 });
-`;
-	const globalsCss = `@import '${uiPackage}/styles';
 `;
 	const layoutTsx = `import type { Metadata } from 'next';
 import { Providers } from './providers.tsx';
@@ -13413,7 +13362,14 @@ export default function RootLayout({
 }
 `;
 	const pageTsx = `import { api } from '~/api/index.ts';
-import { Button, Card, CardContent, CardDescription, CardHeader, CardTitle } from '${uiPackage}/components';
+import { Button } from '~/components/ui/button.tsx';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '~/components/ui/card.tsx';
 
 export default async function Home() {
   // Type-safe API call using the generated client
@@ -13453,7 +13409,7 @@ export default async function Home() {
               <li>Run <code className="rounded bg-muted px-1">gkm openapi</code> to generate typed API client</li>
               <li>Edit <code className="rounded bg-muted px-1">apps/web/src/app/page.tsx</code> to customize this page</li>
               <li>Add API routes in <code className="rounded bg-muted px-1">apps/api/src/endpoints/</code></li>
-              <li>Add UI components with <code className="rounded bg-muted px-1">npx shadcn@latest add</code> in packages/ui</li>
+              <li>Add UI components with <code className="rounded bg-muted px-1">npx shadcn@latest add</code> in apps/web</li>
             </ul>
             <div className="flex gap-4">
               <Button>Get Started</Button>
@@ -13465,6 +13421,11 @@ export default async function Home() {
     </main>
   );
 }
+`;
+	const gitignore = `.next/
+node_modules/
+.env.local
+*.log
 `;
 	return [
 		{
@@ -13485,8 +13446,9 @@ export default async function Home() {
 		},
 		{
 			path: "apps/web/src/app/globals.css",
-			content: globalsCss
+			content: SHADCN_GLOBALS_CSS
 		},
+		...shadcnFiles("apps/web", "src/app/globals.css", { rsc: true }),
 		{
 			path: "apps/web/src/app/layout.tsx",
 			content: layoutTsx
@@ -13521,11 +13483,7 @@ export default async function Home() {
 		},
 		{
 			path: "apps/web/.gitignore",
-			content: `.next/
-node_modules/
-.env.local
-*.log
-`
+			content: gitignore
 		}
 	];
 }
@@ -13541,7 +13499,6 @@ function generateTanStackWebFiles(options) {
 	if (!options.monorepo || options.template !== "fullstack") return [];
 	const packageName = `@${options.name}/web`;
 	const modelsPackage = `@${options.name}/models`;
-	const uiPackage = `@${options.name}/ui`;
 	const packageJson = {
 		name: packageName,
 		version: "0.0.1",
@@ -13555,7 +13512,7 @@ function generateTanStackWebFiles(options) {
 		},
 		dependencies: {
 			[modelsPackage]: "workspace:*",
-			[uiPackage]: "workspace:*",
+			...SHADCN_DEPENDENCIES,
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
@@ -13622,11 +13579,9 @@ export default defineConfig({
 			incremental: true,
 			types: ["vite/client"],
 			paths: {
-				"~/*": ["./src/*", "../../packages/ui/src/*"],
+				"~/*": ["./src/*"],
 				[modelsPackage]: ["../../packages/models/src"],
 				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
-				[uiPackage]: ["../../packages/ui/src"],
-				[`${uiPackage}/*`]: ["../../packages/ui/src/*"],
 				[`@${options.name}/client/*`]: ["../../.gkm/client/*"]
 			}
 		},
@@ -13829,10 +13784,15 @@ function HomeComponent() {
   );
 }
 `;
-	const globalsCss = `@import '${uiPackage}/styles';
-
+	const globalsCss = `${SHADCN_GLOBALS_CSS}
 @source "../..";
-@source "../../../../packages/ui/src";
+`;
+	const gitignore = `.output/
+.vinxi/
+node_modules/
+.env.local
+*.log
+src/routeTree.gen.ts
 `;
 	return [
 		{
@@ -13887,15 +13847,10 @@ function HomeComponent() {
 			path: "apps/web/src/styles/globals.css",
 			content: globalsCss
 		},
+		...shadcnFiles("apps/web", "src/styles/globals.css", { rsc: false }),
 		{
 			path: "apps/web/.gitignore",
-			content: `.output/
-.vinxi/
-node_modules/
-.env.local
-*.log
-src/routeTree.gen.ts
-`
+			content: gitignore
 		}
 	];
 }
@@ -13944,7 +13899,7 @@ const apiTemplate = {
 		const { cache, uploads, mail: sendsMail } = options.constructs;
 		const bucket = storageFor();
 		const kv = cacheFor();
-		const db = databaseFor();
+		databaseFor();
 		const mail = emailFor();
 		const src = (path) => `~/${path}`;
 		const declares = !monorepo;
@@ -14243,41 +14198,6 @@ export const telescope = new Telescope({
   storage: new InMemoryStorage({ maxEntries: 100 }),
   enabled: process.env.NODE_ENV === 'development',
 });
-`
-		});
-		if (options.studio && options.constructs.database) files.push({
-			path: "src/config/studio.ts",
-			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
-import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
-import { type Database, database } from '${declares ? src("constructs/database.ts") : constructsImport("database")}';
-import { envParser } from '${src("config/env.ts")}';
-
-const studioConfig = envParser
-  .create((get) => ({
-    databaseUrl: get('${db.urlKey}').string(),
-  }))
-  .parse();
-
-// Studio's own client, built the way the construct builds its own — the same
-// plugins — so the browser shows what the app's queries see.
-const db = new Kysely<Database>({
-  ...database.clientConfig,
-  dialect: new PostgresDialect({
-    pool: new pg.Pool({ connectionString: studioConfig.databaseUrl }),
-  }),
-});
-
-export const studio = new Studio<Database>({
-  monitoring: {
-    storage: new InMemoryMonitoringStorage({ maxEntries: 100 }),
-  },
-  data: {
-    db,
-    cursor: { field: 'id', direction: Direction.Desc },
-  },
-  enabled: process.env.NODE_ENV === 'development',
-});
 `
 		});
 		return files;
@@ -14325,7 +14245,7 @@ const templates = {
 		},
 		files: (options) => {
 			const { loggerType, routesStructure, name } = options;
-			const db = databaseFor();
+			databaseFor();
 			const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
 export const logger = createLogger();
@@ -14407,40 +14327,6 @@ export const telescope = new Telescope({
   storage: new InMemoryStorage({ maxEntries: 100 }),
   enabled: process.env.NODE_ENV === 'development',
 });
-`
-			});
-			if (options.studio && options.constructs.database) files.push({
-				path: "src/config/studio.ts",
-				content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
-import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
-import type { Database } from '~/constructs/database.ts';
-import { envParser } from '~/config/env.ts';
-
-// The key the database construct publishes — not a hand-written DATABASE_URL.
-const studioConfig = envParser
-  .create((get) => ({
-    databaseUrl: get('${db.urlKey}').string(),
-  }))
-  .parse();
-
-// Create a Kysely instance for Studio
-const db = new Kysely<Database>({
-  dialect: new PostgresDialect({
-    pool: new pg.Pool({ connectionString: studioConfig.databaseUrl }),
-  }),
-});
-
-export const studio = new Studio<Database>({
-  monitoring: {
-    storage: new InMemoryMonitoringStorage({ maxEntries: 100 }),
-  },
-  data: {
-    db,
-    cursor: { field: 'id', direction: Direction.Desc },
-  },
-  enabled: process.env.NODE_ENV === 'development',
-});
 `
 			});
 			return files;
@@ -15161,7 +15047,7 @@ async function initCommand(projectName, options = {}) {
 		{
 			type: options.yes ? null : "confirm",
 			name: "telescope",
-			message: "Include Telescope (debugging dashboard)?",
+			message: "Include Telescope (request, exception and log recording)?",
 			initial: true
 		},
 		{
@@ -15216,13 +15102,11 @@ async function initCommand(projectName, options = {}) {
 	};
 	const pkgManager = options.pm ? options.pm : options.yes ? "pnpm" : answers.packageManager ?? detectedPkgManager;
 	const deployTarget = options.deploy ?? (options.yes ? "none" : answers.deployTarget ?? "none");
-	const database = constructs.database;
 	const frontendFramework = isFullstack ? options.yes ? "nextjs" : answers.frontendFramework ?? "nextjs" : void 0;
 	const templateOptions = {
 		name,
 		template,
 		telescope: options.yes ? true : answers.telescope ?? true,
-		studio: database,
 		loggerType: options.yes ? "pino" : answers.loggerType ?? "pino",
 		routesStructure: options.yes ? "centralized-endpoints" : answers.routesStructure ?? "centralized-endpoints",
 		monorepo,
@@ -15259,7 +15143,6 @@ async function initCommand(projectName, options = {}) {
 	] : [];
 	const webAppFiles = isFullstack ? frontendFramework === "tanstack-start" ? generateTanStackWebFiles(templateOptions) : frontendFramework === "expo" ? generateExpoAppFiles(templateOptions) : generateWebAppFiles(templateOptions) : [];
 	const authAppFiles = isFullstack ? generateAuthAppFiles(templateOptions) : [];
-	const uiPackageFiles = isFullstack ? generateUiPackageFiles(templateOptions) : [];
 	for (const { path, content } of rootFiles) {
 		const fullPath = (0, node_path.join)(targetDir, path);
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(fullPath), { recursive: true });
@@ -15280,11 +15163,6 @@ async function initCommand(projectName, options = {}) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(fullPath), { recursive: true });
 		await (0, node_fs_promises.writeFile)(fullPath, content);
 	}
-	for (const { path, content } of uiPackageFiles) {
-		const fullPath = (0, node_path.join)(targetDir, path);
-		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(fullPath), { recursive: true });
-		await (0, node_fs_promises.writeFile)(fullPath, content);
-	}
 	console.log("🔐 Initializing encrypted secrets...\n");
 	const local = templateOptions.stages.local;
 	const devSecrets = createStageSecrets(local, [], { projectName: name });
@@ -15387,8 +15265,7 @@ function printNextSteps(projectName, options, pkgManager) {
 			}
 		}
 		console.log(`  ├── packages/`);
-		console.log(`  │   ├── models/       # Shared Zod schemas`);
-		if (isFullstackTemplate(options.template)) console.log(`  │   └── ui/           # Shared UI components`);
+		console.log(`  │   └── models/       # Shared Zod schemas`);
 		console.log(`  ├── .gkm/secrets/     # Encrypted secrets`);
 		console.log(`  ├── gkm.config.ts     # Workspace config`);
 		console.log(`  └── turbo.json        # Turbo config`);
@@ -16142,7 +16019,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DN5VM5vy.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DQ54y2WD.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DXNviAh-.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16573,7 +16450,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DN5VM5vy.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DQ54y2WD.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16587,7 +16464,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DN5VM5vy.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DQ54y2WD.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16601,7 +16478,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DN5VM5vy.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DQ54y2WD.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16699,7 +16576,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-tB4LqLKN.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-10Srqiix.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16710,7 +16587,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-tB4LqLKN.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-10Srqiix.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16762,7 +16639,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-DFYu-iRP.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-BbPJVCto.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16821,7 +16698,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BGx4U61b.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DtRUkHN8.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16924,6 +16801,16 @@ program.command("state:show").description("Show deployment state for a stage").r
 		process.exit(1);
 	}
 });
+program.command("state:unlock").description("Release a stage deploy lock left behind by a run that crashed").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await stateUnlockCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("state:diff").description("Compare local and remote deployment state").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16946,12 +16833,19 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
+exports.DocumentStateStore = DocumentStateStore;
+exports.StageStateMissing = StageStateMissing;
+exports.StateLocked = StateLocked;
+exports.StateStoreBusy = StateStoreBusy;
+exports.StateStoreWithoutLocking = StateStoreWithoutLocking;
+exports.StateVersionConflict = StateVersionConflict;
 Object.defineProperty(exports, "appPorts_exports", {
 	enumerable: true,
 	get: function() {
 		return appPorts_exports;
 	}
 });
+exports.contentVersion = contentVersion;
 Object.defineProperty(exports, "encryption_exports", {
 	enumerable: true,
 	get: function() {
@@ -16960,6 +16854,7 @@ Object.defineProperty(exports, "encryption_exports", {
 });
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.getHostingerToken = getHostingerToken;
+exports.newLockHolder = newLockHolder;
 exports.slug = slug;
 exports.stamp = stamp;