@geekmidas/cli 10.0.0-alpha.6 → 10.0.0-alpha.9

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
 import { ConstructGenerator, DEFAULT_CACHE, discover, isPartitionedRoutes } from "./discover-CAlFgYec.mjs";
-import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig, resolveAppSpec } from "./config-CxP7P-qG.mjs";
-import { allConstructGlobs, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stripPublicPrefix } from "./workspace-DIuZx-cc.mjs";
+import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig } from "./config-DVVph9yz.mjs";
+import { allConstructGlobs, assertDeployedStage, deployedProblems, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stageProblems, stripPublicPrefix } from "./workspace-zoqRbihZ.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId, storeHostingerToken } from "./credentials-B5zRHdAl.mjs";
-import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-BK3Z93MX.mjs";
+import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-dP8vRVRv.mjs";
 import { createStageSecrets, rotateServicePassword } from "./generator-VE2JrFlY.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-Bi24WfoW.mjs";
-import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-Bw8DWFWz.mjs";
+import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-Xx0A7Wg0.mjs";
 import { withCompute, withRoutes } from "./emit-CiZS_5Ub.mjs";
 import { DokployApi } from "./dokploy-api-aTFPz7_4.mjs";
 import { encryptSecrets } from "./encryption-D-abyhZx.mjs";
@@ -15,7 +15,7 @@ import { CachedStateProvider } from "./CachedStateProvider-DTniehMP.mjs";
 import { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
 import { generateReactQueryCommand } from "./openapi-react-query-Byltvm_7.mjs";
 import "./sync-CmEuNZsB.mjs";
-import { setupCommand, trustCommand } from "./setup-BWMhbW-p.mjs";
+import { setupCommand, trustCommand } from "./setup-C8KOx8_8.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
@@ -43,7 +43,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "10.0.0-alpha.5";
+var version = "10.0.0-alpha.9";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -143,6 +143,7 @@ var dependencies = {
 	"dotenv": "~18.0.1",
 	"esbuild": "~0.28.2",
 	"fast-glob": "~3.3.3",
+	"get-tsconfig": "~4.10.1",
 	"hono": "~4.13.8",
 	"lodash.kebabcase": "~4.1.1",
 	"openapi-typescript": "~7.13.0",
@@ -157,8 +158,8 @@ var devDependencies = {
 	"@types/node": "~24.9.1",
 	"@types/pg": "~8.23.1",
 	"@types/prompts": "~2.4.9",
-	"typescript": "^5.8.2",
-	"vitest": "^3.2.4",
+	"typescript": "~5.8.2",
+	"vitest": "~3.2.4",
 	"zod": "~4.6.5"
 };
 var peerDependencies = { "@geekmidas/telescope": "workspace:~" };
@@ -1377,9 +1378,9 @@ async function devCommand(options) {
 	if (enableOpenApi) await generateOpenApiFrom(config.constructs, { openapi: config.openapi });
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
-	const appSecrets = await loadSecretsForApp(secretsRoot, workspaceAppName);
+	const appSecrets = await loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
 	if (workspace && usesConstructs(workspace)) {
-		const reconciled = await reconcileWorkspace(workspace, { stage: "development" });
+		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
@@ -1661,15 +1662,15 @@ async function validateFrontendApps(workspace) {
 */
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
-	const stages = ["dev", "development"];
-	for (const stage of stages) if (secretsExist(stage, workspace.root)) {
+	const stage = workspace.stages.local;
+	if (secretsExist(stage, workspace.root)) {
 		const secrets = await readStageSecrets(stage, workspace.root);
 		if (secrets) {
 			logger$9.log(`🔐 Loading secrets from stage: ${stage}`);
 			return toEmbeddableSecrets(secrets);
 		}
 	}
-	logger$9.warn("⚠️  Secrets enabled but no dev/development secrets found. Run \"gkm setup\" to initialize your development environment");
+	logger$9.warn(`⚠️  Secrets enabled but no "${stage}" secrets found. Run "gkm setup" to initialize the local stage`);
 	return {};
 }
 /**
@@ -1713,7 +1714,7 @@ async function workspaceDevCommand(workspace, options) {
 	const rawSecrets = await loadDevSecrets(workspace);
 	let secretsEnv;
 	if (usesConstructs(workspace)) {
-		const reconciled = await reconcileWorkspace(workspace, { stage: "development" });
+		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
@@ -2458,6 +2459,7 @@ function rootGkmConfig(workspace) {
 	const own = only ? getAppGkmConfig(workspace, only[0]) : void 0;
 	return own ?? {
 		services: workspace.services,
+		stages: workspace.stages,
 		constructs: allConstructGlobs(workspace)
 	};
 }
@@ -2465,9 +2467,9 @@ async function buildCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
 		const cwd = resolve(process.cwd());
-		const workspaceRoot = resolve(loadedConfig.workspace.root);
-		const isAtWorkspaceRoot = cwd === workspaceRoot;
-		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => resolve(workspaceRoot, app.path) !== workspaceRoot);
+		const workspaceRoot$1 = resolve(loadedConfig.workspace.root);
+		const isAtWorkspaceRoot = cwd === workspaceRoot$1;
+		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => resolve(workspaceRoot$1, app.path) !== workspaceRoot$1);
 		if (isAtWorkspaceRoot && someAppIsElsewhere) {
 			logger$7.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
@@ -2506,7 +2508,9 @@ async function buildCommand(options) {
 		sources: constructSources
 	}) : {};
 	const surfaces = Object.values(declared).filter((d) => d.kind === "rest-api");
-	const primary = surfaces.find((d) => d.endpoints.length === 0) ?? surfaces[0];
+	const workspaceRoot = loadedConfig.workspace.root;
+	const served = surfaces.find((d) => resolve(workspaceRoot, d.path) === resolve(process.cwd()));
+	const primary = served ?? surfaces.find((d) => d.endpoints.length === 0) ?? surfaces[0];
 	const browsable = Object.entries(declared).find(([, d]) => d.kind === "database");
 	const browsableSource = browsable ? constructSources[browsable[0]] : void 0;
 	const owners = {};
@@ -2557,7 +2561,7 @@ async function buildCommand(options) {
 	const queueGenerator = new QueueGenerator();
 	const topicGenerator = new TopicGenerator();
 	const code = constructGlobs$1;
-	const [allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
+	const [loadedEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
 		endpointGenerator.load(code),
 		functionGenerator.load(code),
 		cronGenerator.load(code),
@@ -2565,6 +2569,7 @@ async function buildCommand(options) {
 		queueGenerator.load(code),
 		topicGenerator.load(code)
 	]);
+	const allEndpoints = primary ? loadedEndpoints.filter(({ construct }) => !construct.surface || construct.surface.id === primary.id) : loadedEndpoints;
 	logger$7.log(`Found ${allEndpoints.length} endpoints`);
 	logger$7.log(`Found ${allFunctions.length} functions`);
 	logger$7.log(`Found ${allCrons.length} crons`);
@@ -2572,7 +2577,7 @@ async function buildCommand(options) {
 	logger$7.log(`Found ${allQueues.length} queues`);
 	logger$7.log(`Found ${allTopics.length} topics`);
 	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		const selfServing = Object.entries(declared).find(([id, d]) => d.kind === "rest-api" && d.endpoints.length > 0 && constructSources[id] !== void 0 && resolve(loadedConfig.workspace.root, resolveAppSpec(id, d.app ?? {}, loadedConfig.workspace.root).path) === resolve(process.cwd()));
+		const selfServing = served && served.endpoints.length > 0 && constructSources[served.id] !== void 0 ? [served.id, served] : void 0;
 		if (selfServing) {
 			const [id] = selfServing;
 			await writeSurfaceEntry(join(process.cwd(), ".gkm", "server"), constructSources[id]);
@@ -2843,7 +2848,6 @@ async function workspaceBuildCommand(workspace, options) {
 			});
 		}
 		logger$7.log(`\n✅ Workspace build complete!`);
-		await openapiCommand({ cwd: workspace.root });
 		logger$7.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
@@ -5693,7 +5697,7 @@ async function workspaceDockerCommand(workspace, options) {
 	logger$5.log(`\n   Generated: .dockerignore (workspace root)`);
 	const dockerCompose = generateWorkspaceCompose(workspace, {
 		registry: options.registry,
-		containers: await derivedContainers(workspace, "development")
+		containers: await derivedContainers(workspace, workspace.stages.local)
 	});
 	const composePath = join(dockerDir, "docker-compose.yml");
 	await writeFile(composePath, dockerCompose);
@@ -7139,6 +7143,7 @@ async function workspaceDeployCommand(configured, options) {
 */
 async function deployCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
+	assertDeployedStage(loadedConfig.workspace.stages, options.stage);
 	return workspaceDeployCommand(loadedConfig.workspace, options);
 }
 
@@ -7514,47 +7519,47 @@ const CONSTRUCTS_GLOB = "./src/constructs/**/*.ts";
 */
 const WORKSPACE_CONSTRUCTS_GLOB = "./constructs/**/*.ts";
 /**
-* The database a project named `name` declares.
+* Where each routes structure puts an app's handlers, relative to the app.
 *
-* Named after the project rather than `Db`, so two apps in one workspace can
-* declare one each without colliding on an id or on an env key.
+* `.ts` only, never `.tsx`: a TanStack site keeps its own `src/routes/`, and
+* this glob must not import a frontend's route components.
 */
-function databaseFor(name$1) {
-	const id = canonicalId(name$1);
-	return {
-		id,
-		service: serviceKey(id),
-		urlKey: provideKey(id, "url"),
-		ownerUrlKey: provideKey(id, "ownerUrl")
-	};
-}
-/** The bucket a project named `name` declares. */
-function storageFor(name$1) {
-	const id = canonicalId(`${name$1}-uploads`);
-	return {
-		id,
-		service: serviceKey(id),
-		urlKey: provideKey(id, "url")
-	};
+function routesGlob(structure) {
+	switch (structure) {
+		case "centralized-endpoints": return "./src/endpoints/**/*.ts";
+		case "centralized-routes": return "./src/routes/**/*.ts";
+		case "domain-based": return "./src/**/routes/*.ts";
+	}
 }
-/** The mail sender a project named `name` declares. */
-function emailFor(name$1) {
-	const id = canonicalId(`${name$1}-mail`);
+/**
+* Plain ids — `Database`, not `Beetlefit`.
+*
+* The workspace `name` already scopes every physical name
+* (`production-beetlefit-database`), so an id that carried the project too
+* would say it twice: `production-beetlefit-beetlefit-cache`. Within a
+* workspace the constructs are declared once, at its root, so there is no
+* second app's `Database` to collide with.
+*/
+function scaffolded(id) {
 	return {
 		id,
 		service: serviceKey(id),
 		urlKey: provideKey(id, "url")
 	};
 }
-/** The cache a project named `name` declares. */
-function cacheFor(name$1) {
-	const id = canonicalId(`${name$1}-cache`);
+/** The database a project declares. */
+function databaseFor() {
 	return {
-		id,
-		service: serviceKey(id),
-		urlKey: provideKey(id, "url")
+		...scaffolded("Database"),
+		ownerUrlKey: provideKey("Database", "ownerUrl")
 	};
 }
+/** The bucket a project declares. */
+const storageFor = () => scaffolded("Uploads");
+/** The mail sender a project declares. */
+const emailFor = () => scaffolded("Mail");
+/** The cache a project declares. */
+const cacheFor = () => scaffolded("Cache");
 /**
 * The files a project's declared database needs.
 *
@@ -7562,8 +7567,8 @@ function cacheFor(name$1) {
 * the same way — and so the schema type, the migration, and the id the test
 * setup reads all come from one place.
 */
-function databaseFiles(name$1) {
-	const db = databaseFor(name$1);
+function databaseFiles() {
+	const db = databaseFor();
 	return [{
 		path: "src/constructs/database.ts",
 		content: `import { KyselyDatabase } from '@geekmidas/constructs/database/kysely';
@@ -7592,7 +7597,16 @@ export interface Database {
  */
 export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}');
 `
-	}, {
+	}, usersMigration()];
+}
+/**
+* The table the scaffolded endpoints and factories expect.
+*
+* Its own function because a workspace's API needs it without the database
+* construct beside it — that one lives at the workspace root.
+*/
+function usersMigration() {
+	return {
 		path: "src/db/migrations/001_create_users.ts",
 		content: `import type { Kysely } from 'kysely';
 
@@ -7620,7 +7634,18 @@ export async function down(db: Kysely<unknown>): Promise<void> {
   await db.schema.dropTable('users').execute();
 }
 `
-	}];
+	};
+}
+/**
+* What a workspace's `constructs` glob reaches: the root constructs, and the
+* handlers of every app laid out the way `init` was told.
+*
+* Every app in `appsDir` (`apps/*`) rather than the API's own directory.
+* Endpoints are split by the surface they were built from, so naming one app
+* here would only decide which apps' endpoints are silently never loaded.
+*/
+function workspaceConstructsGlobs(structure, appsDir) {
+	return [WORKSPACE_CONSTRUCTS_GLOB, `./${appsDir}/*/${routesGlob(structure).replace(/^\.\//, "")}`];
 }
 
 //#endregion
@@ -7700,6 +7725,7 @@ what the OpenAPI spec says, which env vars a process needs.
 \`\`\`typescript
 export default defineWorkspace({
   name: '${name$1}',
+  stages: { local: 'dev', deployed: ['staging', 'prod'], protected: ['prod'] },
   constructs: '${constructsGlob}',
   secrets: { enabled: true },
 });
@@ -7954,6 +7980,30 @@ ${database ? "gkm test       # starts services, injects secrets, then runs vites
 Run tests through \`gkm test\`, not \`vitest\` directly${database ? " — it is what starts the database and injects the secrets the suite needs" : ""}.`;
 }
 
+//#endregion
+//#region src/init/dependencies.ts
+/**
+* Third-party ranges a scaffold installs beside the `@geekmidas` packages.
+*
+* Held to the peer ranges those packages declare, in one place, because a
+* template that pinned its own copy drifted below them: `kysely ~0.28` against
+* a `~0.29.6` peer is two copies of Kysely and a `Kysely<DB>` from one that is
+* not assignable to the other's.
+*
+* Hand-maintained, unlike `versions.ts`, which `sync-versions` rewrites whole.
+*/
+const DEPENDENCY_VERSIONS = {
+	"@tanstack/react-query": "~5.80.0",
+	"better-auth": "~1.7.5",
+	hono: "~4.13.8",
+	kysely: "~0.29.6",
+	"kysely-ctl": "~0.21.0",
+	pg: "~8.23.0",
+	pino: "~10.3.1",
+	sst: "~4.17.1",
+	zod: "~4.6.5"
+};
+
 //#endregion
 //#region src/init/versions.ts
 const require$1 = createRequire(import.meta.url);
@@ -7976,26 +8026,26 @@ const CLI_VERSION = `~${pkg.version}`;
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.5",
-	"@geekmidas/auth": "~10.0.0-alpha.5",
-	"@geekmidas/cache": "~10.0.0-alpha.5",
-	"@geekmidas/client": "~10.0.0-alpha.5",
-	"@geekmidas/cloud": "~10.0.0-alpha.5",
-	"@geekmidas/constructs": "~10.0.0-alpha.5",
-	"@geekmidas/db": "~10.0.0-alpha.5",
-	"@geekmidas/emailkit": "~10.0.0-alpha.5",
-	"@geekmidas/envkit": "~10.0.0-alpha.5",
-	"@geekmidas/errors": "~10.0.0-alpha.5",
-	"@geekmidas/events": "~10.0.0-alpha.5",
-	"@geekmidas/logger": "~10.0.0-alpha.5",
-	"@geekmidas/manifest": "~10.0.0-alpha.5",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.5",
-	"@geekmidas/schema": "~10.0.0-alpha.5",
-	"@geekmidas/services": "~10.0.0-alpha.5",
-	"@geekmidas/storage": "~10.0.0-alpha.5",
-	"@geekmidas/studio": "~10.0.0-alpha.5",
-	"@geekmidas/telescope": "~10.0.0-alpha.5",
-	"@geekmidas/testkit": "~10.0.0-alpha.5",
+	"@geekmidas/audit": "~10.0.0-alpha.9",
+	"@geekmidas/auth": "~10.0.0-alpha.9",
+	"@geekmidas/cache": "~10.0.0-alpha.9",
+	"@geekmidas/client": "~10.0.0-alpha.9",
+	"@geekmidas/cloud": "~10.0.0-alpha.9",
+	"@geekmidas/constructs": "~10.0.0-alpha.9",
+	"@geekmidas/db": "~10.0.0-alpha.9",
+	"@geekmidas/emailkit": "~10.0.0-alpha.9",
+	"@geekmidas/envkit": "~10.0.0-alpha.9",
+	"@geekmidas/errors": "~10.0.0-alpha.9",
+	"@geekmidas/events": "~10.0.0-alpha.9",
+	"@geekmidas/logger": "~10.0.0-alpha.9",
+	"@geekmidas/manifest": "~10.0.0-alpha.9",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.9",
+	"@geekmidas/schema": "~10.0.0-alpha.9",
+	"@geekmidas/services": "~10.0.0-alpha.9",
+	"@geekmidas/storage": "~10.0.0-alpha.9",
+	"@geekmidas/studio": "~10.0.0-alpha.9",
+	"@geekmidas/telescope": "~10.0.0-alpha.9",
+	"@geekmidas/testkit": "~10.0.0-alpha.9",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -8015,27 +8065,28 @@ function generateAuthAppFiles(options) {
 		private: true,
 		type: "module",
 		scripts: {
-			dev: "gkm dev --entry ./src/index.ts",
-			build: "tsc",
-			start: "node dist/index.js",
-			typecheck: "tsc --noEmit",
+			dev: "gkm dev",
+			build: "gkm build",
 			"db:migrate": "gkm exec -- npx @better-auth/cli migrate",
 			"db:generate": "gkm exec -- npx @better-auth/cli generate"
 		},
 		dependencies: {
 			[modelsPackage]: "workspace:*",
+			"@geekmidas/auth": GEEKMIDAS_VERSIONS["@geekmidas/auth"],
+			"@geekmidas/constructs": GEEKMIDAS_VERSIONS["@geekmidas/constructs"],
+			"@geekmidas/db": GEEKMIDAS_VERSIONS["@geekmidas/db"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
-			"@hono/node-server": "~1.13.0",
-			"better-auth": "~1.2.0",
-			hono: "~4.8.0",
-			kysely: "~0.27.0",
-			pg: "~8.13.0"
+			"@hono/node-server": "~1.14.1",
+			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
+			hono: DEPENDENCY_VERSIONS.hono,
+			kysely: DEPENDENCY_VERSIONS.kysely,
+			pg: DEPENDENCY_VERSIONS.pg
 		},
 		devDependencies: {
 			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
 			"@types/node": "~22.0.0",
-			"@types/pg": "~8.11.0",
+			"@types/pg": "~8.23.1",
 			tsx: "~4.20.0",
 			typescript: "~5.8.2"
 		}
@@ -8075,6 +8126,30 @@ dist/
 	];
 }
 
+//#endregion
+//#region src/init/generators/stages.ts
+/** The `stages` block a generated gkm.config.ts declares, indented two spaces. */
+function stagesBlock(stages) {
+	const list = (names) => `[${names.map((name$1) => `'${name$1}'`).join(", ")}]`;
+	return `
+  // Named by this project and read by every command: \`gkm dev\`, \`exec\` and
+  // \`test\` run as \`local\`, and \`gkm deploy --stage\` accepts only \`deployed\`.
+  stages: {
+    local: '${stages.local}',
+    deployed: ${list(stages.deployed)},${stages.protected?.length ? `
+    // Retained and protected on removal.
+    protected: ${list(stages.protected)},` : ""}
+  },`;
+}
+/**
+* The `STAGE` the scaffolded env config parses: one of the declared stages,
+* defaulting to the local one.
+*/
+function stageEnv(stages) {
+	const names = [stages.local, ...stages.deployed].map((name$1) => `'${name$1}'`).join(", ");
+	return `get('STAGE').enum([${names}]).default('${stages.local}')`;
+}
+
 //#endregion
 //#region src/init/generators/config.ts
 /**
@@ -8099,13 +8174,7 @@ function generateConfigFiles(options, template) {
 	const isServerless = template.name === "serverless";
 	const hasWorker = template.name === "worker";
 	const isFullstack = options.template === "fullstack";
-	const getRoutesGlob = () => {
-		switch (routesStructure) {
-			case "centralized-endpoints": return "./src/endpoints/**/*.ts";
-			case "centralized-routes": return "./src/routes/**/*.ts";
-			case "domain-based": return "./src/**/routes/*.ts";
-		}
-	};
+	const getRoutesGlob = () => routesGlob(routesStructure);
 	if (isFullstack) return generateSingleAppConfigFiles(options, template, {
 		telescope,
 		studio,
@@ -8116,7 +8185,7 @@ function generateConfigFiles(options, template) {
 	});
 	let gkmConfig = `import { defineConfig } from '@geekmidas/cli/config';
 
-export default defineConfig({${options.monorepo ? "" : `
+export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ? "" : `
   // One glob, every kind. What reconcile reads to derive the containers this
   // app needs: a declared database is why a Postgres exists at all, so nothing
   // lists \`postgres\` anywhere.
@@ -8158,21 +8227,7 @@ export default defineConfig({${options.monorepo ? "" : `
 	gkmConfig += `
 });
 `;
-	const tsConfig = options.monorepo ? {
-		extends: "../../tsconfig.json",
-		compilerOptions: {
-			noEmit: true,
-			allowImportingTsExtensions: true,
-			baseUrl: ".",
-			paths: {
-				"~/*": ["./src/*"],
-				[`@${options.name}/constructs/*`]: ["../../constructs/*"],
-				[`@${options.name}/*`]: ["../../packages/*/src"]
-			}
-		},
-		include: ["src/**/*.ts"],
-		exclude: ["node_modules", "dist"]
-	} : {
+	const tsConfig = options.monorepo ? workspaceApiTsConfig(options.name) : {
 		compilerOptions: {
 			target: "ES2022",
 			module: "NodeNext",
@@ -8212,7 +8267,7 @@ export default defineConfig({${options.monorepo ? "" : `
 			clientKind: "git",
 			useIgnoreFile: true
 		},
-		organizeImports: { enabled: true },
+		assist: { actions: { source: { organizeImports: "on" } } },
 		formatter: {
 			enabled: true,
 			indentStyle: "space",
@@ -8236,11 +8291,13 @@ export default defineConfig({${options.monorepo ? "" : `
 				style: { noNonNullAssertion: "off" }
 			}
 		},
-		files: { ignore: [
-			"node_modules",
-			"dist",
-			".gkm",
-			"coverage"
+		css: { parser: { tailwindDirectives: true } },
+		files: { includes: [
+			"**",
+			"!**/node_modules",
+			"!**/dist",
+			"!**/.gkm",
+			"!**/coverage"
 		] }
 	};
 	const turboConfig = {
@@ -8294,8 +8351,16 @@ export default defineConfig({${options.monorepo ? "" : `
 	});
 	return files$1;
 }
-function generateSingleAppConfigFiles(options, _template, _helpers) {
-	const tsConfig = {
+/**
+* The tsconfig of an API inside a workspace.
+*
+* One definition for both ways of getting one — the fullstack template and
+* `--monorepo` — because the two copies had drifted: only one of them mapped
+* the root constructs, so in the other `@<name>/constructs/api.ts` fell through
+* to the `packages/` mapping and nothing could load the surface.
+*/
+function workspaceApiTsConfig(name$1) {
+	return {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
@@ -8303,12 +8368,16 @@ function generateSingleAppConfigFiles(options, _template, _helpers) {
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
-				[`@${options.name}/*`]: ["../../packages/*/src"]
+				[`@${name$1}/constructs/*`]: ["../../constructs/*"],
+				[`@${name$1}/*`]: ["../../packages/*/src"]
 			}
 		},
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
+}
+function generateSingleAppConfigFiles(options, _template, _helpers) {
+	const tsConfig = workspaceApiTsConfig(options.name);
 	const files$1 = [{
 		path: "tsconfig.json",
 		content: `${JSON.stringify(tsConfig, null, 2)}\n`
@@ -8717,12 +8786,12 @@ function generateExpoAppFiles(options) {
 		dependencies: {
 			[apiPackage]: "workspace:*",
 			[modelsPackage]: "workspace:*",
-			"@better-auth/expo": "~1.2.0",
+			"@better-auth/expo": DEPENDENCY_VERSIONS["better-auth"],
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@react-navigation/native": "^7.1.0",
-			"@tanstack/react-query": "~5.80.0",
-			"better-auth": "~1.2.0",
+			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
+			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
 			expo: "~55.0.0",
 			"expo-constants": "~55.0.0",
 			"expo-dev-client": "~55.0.0",
@@ -8858,7 +8927,7 @@ module.exports = withNativeWind(config, { input: './global.css' });
 				"@/*": ["./*"],
 				[modelsPackage]: ["../../packages/models/src"],
 				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
-				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi.ts"]
+				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi/api.ts"]
 			}
 		},
 		include: [
@@ -9416,14 +9485,142 @@ export type ListUsersResponse = z.infer<typeof ListUsersResponseSchema>;
 	];
 }
 
+//#endregion
+//#region src/init/generators/deploy.ts
+/** One `deploy:<stage>` script per deployed stage. */
+const perStage = (options, command) => Object.fromEntries(options.stages.deployed.map((stage) => [`deploy:${stage}`, command(stage)]));
+function deployPackage(options) {
+	switch (options.deployTarget) {
+		case "dokploy": return {
+			scripts: perStage(options, (stage) => `gkm deploy --provider dokploy --stage ${stage}`),
+			dependencies: {},
+			devDependencies: {}
+		};
+		case "sst": {
+			const v = GEEKMIDAS_VERSIONS;
+			return {
+				scripts: perStage(options, (stage) => `gkm build --provider aws && sst deploy --stage ${stage}`),
+				dependencies: {
+					"@geekmidas/cloud": v["@geekmidas/cloud"],
+					"@geekmidas/db": v["@geekmidas/db"],
+					"@geekmidas/envkit": v["@geekmidas/envkit"],
+					"@geekmidas/events": v["@geekmidas/events"],
+					"@geekmidas/manifest": v["@geekmidas/manifest"],
+					"@geekmidas/storage": v["@geekmidas/storage"],
+					pg: DEPENDENCY_VERSIONS.pg
+				},
+				devDependencies: { sst: DEPENDENCY_VERSIONS.sst }
+			};
+		}
+		default: return {
+			scripts: {},
+			dependencies: {},
+			devDependencies: {}
+		};
+	}
+}
+function generateDeployFiles(options) {
+	if (options.deployTarget !== "sst") return [];
+	if (!options.region) throw new Error("An SST deploy needs a region.");
+	const db = databaseFor();
+	const mail = emailFor();
+	const hasDatabase = options.template === "fullstack" || options.services.db;
+	const inputs = [...hasDatabase ? [`        // RDS needs a network. Created here rather than assumed, because a
+        // VPC with NAT is a monthly cost in an account that may already
+        // have one — replace it with \`sst.aws.Vpc.get(…)\` if so.
+        ${db.id}: { vpc },`] : [], ...options.services.mail ? [`        // Every provider rejects an unverified sender, so there is no
+        // default; the synth stops with \`EmailNeedsSender\` until it is set.
+        ${mail.id}: { from: process.env.MAIL_FROM as string },`] : []];
+	return [{
+		path: "sst.config.ts",
+		content: `/// <reference path="./.sst/platform/config.d.ts" />
+
+/**
+ * ${options.name} on AWS.
+ *
+ * No bucket, cluster, queue or IAM is listed here: they come from the
+ * constructs the application declares, through \`fromManifest\`. What is here
+ * is what varies by stage, and the inputs a declaration cannot carry.
+ *
+ * Deploy with \`pnpm run deploy:<stage>\`, which builds the manifest first.
+ */
+const region = '${options.region}';
+
+/** From \`stages.protected\` in gkm.config.ts. */
+const PROTECTED: string[] = ${JSON.stringify(options.stages.protected ?? []).replace(/"/g, "'")};
+
+export default $config({
+  app(input) {
+    return {
+      name: '${options.name}',
+      // Any other stage is disposable; a protected one's database should not
+      // vanish because somebody removed a stack.
+      removal: PROTECTED.includes(input?.stage) ? 'retain' : 'remove',
+      protect: PROTECTED.includes(input?.stage),
+      home: 'aws',
+      providers: { aws: { region } },
+    };
+  },
+
+  async run() {
+    const { App, fromManifest, Stack } = await import('@geekmidas/cloud/sst');
+    // Written by \`gkm build --provider aws\`. Imported rather than discovered,
+    // so SST's toolchain never evaluates the application's own modules.
+    const { backends, constructs } = await import('./.gkm/manifest/aws.js');
+
+${hasDatabase ? "    const vpc = new sst.aws.Vpc('Vpc', { nat: 'ec2' });\n\n" : ""}    const app = new App({
+      name: $app.name,
+      stage: $app.stage,
+      domain: '',
+      region,
+      hostedZoneId: '',
+    });
+
+    return fromManifest(
+      new Stack(app, '${canonicalId(options.name)}'),
+      constructs,
+      {
+${inputs.join("\n")}
+      },
+      backends,
+    );
+  },
+});
+`
+	}];
+}
+
 //#endregion
 //#region src/init/generators/monorepo.ts
 /**
+* What the root `constructs/` folder imports, and the peers each construct
+* needs, for the services this workspace was scaffolded with.
+*/
+function rootConstructDependencies(options) {
+	const v = GEEKMIDAS_VERSIONS;
+	return {
+		"@geekmidas/constructs": v["@geekmidas/constructs"],
+		"@geekmidas/logger": v["@geekmidas/logger"],
+		...options.loggerType === "pino" ? { pino: DEPENDENCY_VERSIONS.pino } : {},
+		"@geekmidas/telescope": v["@geekmidas/telescope"],
+		"@geekmidas/auth": v["@geekmidas/auth"],
+		"better-auth": DEPENDENCY_VERSIONS["better-auth"],
+		"@geekmidas/db": v["@geekmidas/db"],
+		kysely: DEPENDENCY_VERSIONS.kysely,
+		pg: DEPENDENCY_VERSIONS.pg,
+		...options.services.storage ? { "@geekmidas/storage": v["@geekmidas/storage"] } : {},
+		...options.services.mail ? { "@geekmidas/emailkit": v["@geekmidas/emailkit"] } : {},
+		...options.services.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {}
+	};
+}
+/**
 * Generate monorepo root files (pnpm-workspace.yaml, root package.json, etc.)
 */
 function generateMonorepoFiles(options, _template) {
 	if (!options.monorepo) return [];
 	const isFullstack = options.template === "fullstack";
+	const deploy = deployPackage(options);
+	const isSst = options.deployTarget === "sst";
 	const rootPackageJson = {
 		name: options.name,
 		version: "0.0.1",
@@ -9440,9 +9637,13 @@ function generateMonorepoFiles(options, _template) {
 			fmt: "biome format . --write",
 			"fmt:check": "biome format .",
 			...isFullstack ? { storybook: "pnpm --filter ./packages/ui storybook" } : {},
-			...options.deployTarget === "dokploy" ? { deploy: "gkm deploy --provider dokploy --stage production" } : {}
+			...deploy.scripts
+		},
+		dependencies: {
+			zod: DEPENDENCY_VERSIONS.zod,
+			...isFullstack ? rootConstructDependencies(options) : {},
+			...deploy.dependencies
 		},
-		dependencies: { zod: "~4.1.0" },
 		devDependencies: {
 			"@biomejs/biome": "~2.3.0",
 			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
@@ -9450,7 +9651,8 @@ function generateMonorepoFiles(options, _template) {
 			tsx: "~4.20.0",
 			turbo: "~2.3.0",
 			typescript: "~5.8.2",
-			vitest: "~4.0.0"
+			vitest: "~4.0.0",
+			...deploy.devDependencies
 		}
 	};
 	const apiPathParts = options.apiPath.split("/");
@@ -9466,7 +9668,7 @@ function generateMonorepoFiles(options, _template) {
 			clientKind: "git",
 			useIgnoreFile: true
 		},
-		organizeImports: { enabled: true },
+		assist: { actions: { source: { organizeImports: "on" } } },
 		formatter: {
 			enabled: true,
 			indentStyle: "space",
@@ -9490,11 +9692,14 @@ function generateMonorepoFiles(options, _template) {
 				style: { noNonNullAssertion: "off" }
 			}
 		},
-		files: { ignore: [
-			"node_modules",
-			"dist",
-			".gkm",
-			"coverage"
+		css: { parser: { tailwindDirectives: true } },
+		files: { includes: [
+			"**",
+			"!**/node_modules",
+			"!**/dist",
+			"!**/.gkm",
+			"!**/coverage",
+			...isSst ? ["!**/.sst", "!sst-env.d.ts"] : []
 		] }
 	};
 	const turboConfig = {
@@ -9560,12 +9765,14 @@ coverage/
 
 # Turbo
 .turbo/
-`;
+${isSst ? "\n# SST\n.sst/\n" : ""}`;
 	const tsConfig = {
 		compilerOptions: {
 			...isFullstack ? {
 				baseUrl: ".",
-				paths: { [`@${options.name}/constructs/*`]: ["./constructs/*"] }
+				paths: { [`@${options.name}/constructs/*`]: ["./constructs/*"] },
+				allowImportingTsExtensions: true,
+				noEmit: true
 			} : {},
 			target: "ES2022",
 			module: "NodeNext",
@@ -9577,16 +9784,21 @@ coverage/
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true
 		},
-		exclude: ["node_modules", "dist"]
+		exclude: [
+			"node_modules",
+			"dist",
+			...isSst ? ["sst.config.ts", ".sst"] : []
+		]
 	};
 	const vitestConfig = `import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   test: {
-    globals: true,
-    environment: 'node',
-    include: ['apps/**/*.{test,spec}.ts', 'packages/**/*.{test,spec}.ts'],
-    exclude: ['**/node_modules/**', '**/dist/**'],
+    // Each app and package is its own project, so its own config — an app's
+    // \`globalSetup\`, its path aliases — applies to its own tests.
+    projects: ['apps/*', 'packages/*'],
+    // The shared packages ship without tests of their own.
+    passWithNoTests: true,
     coverage: {
       provider: 'v8',
       reporter: ['text', 'json', 'html'],
@@ -9667,7 +9879,8 @@ export default defineConfig({
 		{
 			path: ".vscode/extensions.json",
 			content: `${JSON.stringify(vscodeExtensions, null, "	")}\n`
-		}
+		},
+		...generateDeployFiles(options)
 	];
 	if (isFullstack) files$1.push({
 		path: "gkm.config.ts",
@@ -9694,12 +9907,17 @@ export default defineWorkspace({
   // The scope every physical name is built from: \`Database\` becomes
   // \`production-${options.name}-database\` on Dokploy and on AWS alike.
   name: '${options.name}',
+${stagesBlock(options.stages)}
 
-  // One glob, every kind. A declared database is why a Postgres exists, a
+  // Every kind, in every app. A declared database is why a Postgres exists, a
   // declared bucket is why MinIO does, a declared topic is why a broker does —
   // none of it listed here. It is also where the apps come from: a
-  // \`StaticSite\` is an app, and so is every \`RestApi\`.
-  constructs: '${WORKSPACE_CONSTRUCTS_GLOB}',
+  // \`StaticSite\` is an app, and so is every \`RestApi\`. And it finds each
+  // app's endpoints, crons and subscribers: an endpoint belongs to the surface
+  // it was built from, not to the directory it sits in.
+  constructs: [
+${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).map((glob) => `    '${glob}',`).join("\n")}
+  ],
 
   secrets: {
     enabled: true,
@@ -9728,7 +9946,7 @@ export default defineWorkspace({
 function generateRootConstructs(options) {
 	if (!options.monorepo || options.template !== "fullstack") return [];
 	const { name: name$1, services, frontendFramework } = options;
-	const db = databaseFor(name$1);
+	const db = databaseFor();
 	const files$1 = [];
 	files$1.push({
 		path: "constructs/logger.ts",
@@ -9794,6 +10012,7 @@ import { authDb } from './database.ts';
  * origin down.
  */
 export const auth = new BetterAuth('Auth', {
+  path: 'apps/auth',
   database: authDb,
   basePath: '/api/auth',
 });
@@ -9808,25 +10027,22 @@ import { logger } from './logger.ts';
 /**
  * The application's HTTP surface — one RestApi, one container.
  *
- * No \`app\`: \`Api\` means \`apps/api\`, which the id already said. The
- * \`code\` glob is here only because this scaffold puts its endpoints under
- * \`src/\`, where the conventional layout has them at the app root.
+ * \`path\` is where its app lives. Its handlers are found by the workspace's
+ * \`constructs\` glob, and belong to it because they were built from it.
  */
 export const api = new RestApi('Api', {
+  path: '${options.apiPath}',
+
   // Typed out rather than omitted: an API that ships open because a field was
   // left off is the one default worth refusing to have.
   defaultAuthorizer: 'none',
 
   // The actual logger, not a path to one.
   logger,
-
-  app: {
-    code: './src/{endpoints,functions,crons,queues,topics,subscribers}/**/*.ts',
-  },
 }).auth(auth);
 `
 	});
-	const variant = frontendFramework === "tanstack-start" ? "{ variant: 'tanstack' }" : frontendFramework === "expo" ? void 0 : "{ variant: 'next' }";
+	const variant = frontendFramework === "tanstack-start" ? "{ path: 'apps/web', variant: 'tanstack' }" : frontendFramework === "expo" ? void 0 : "{ path: 'apps/web', variant: 'next' }";
 	if (variant !== void 0) files$1.push({
 		path: "constructs/site.ts",
 		content: `import { StaticSite } from '@geekmidas/constructs/site';
@@ -9836,7 +10052,7 @@ import { auth } from './auth.ts';
 /**
  * The frontend — a construct like any other, which is what makes it an app.
  *
- * No \`path\`: \`Web\` means \`apps/web\`. \`.dependsOn()\` is the single fact
+ * \`path\` is where it lives. \`.dependsOn()\` is the single fact
  * behind four things that are hand-maintained otherwise: this site's
  * build-time API URL, the API's CORS origins, the auth server's trusted
  * origins, and which generated client lands here.
@@ -9845,7 +10061,7 @@ export const web = new StaticSite('Web', ${variant}).dependsOn([api, auth]);
 `
 	});
 	if (services.storage) {
-		const bucket = storageFor(name$1);
+		const bucket = storageFor();
 		files$1.push({
 			path: "constructs/storage.ts",
 			content: `import { ObjectStorage } from '@geekmidas/constructs/object-storage';
@@ -9856,7 +10072,7 @@ export const uploads = new ObjectStorage('${bucket.id}');
 		});
 	}
 	if (services.mail) {
-		const mail = emailFor(name$1);
+		const mail = emailFor();
 		files$1.push({
 			path: "constructs/email.ts",
 			content: `import { Email } from '@geekmidas/constructs/email';
@@ -9867,7 +10083,7 @@ export const email = new Email('${mail.id}', { templates: {} });
 		});
 	}
 	if (services.cache) {
-		const kv = cacheFor(name$1);
+		const kv = cacheFor();
 		files$1.push({
 			path: "constructs/cache.ts",
 			content: `import { Cache } from '@geekmidas/constructs/cache';
@@ -9900,9 +10116,9 @@ const apiTemplate = {
 		"@geekmidas/errors": GEEKMIDAS_VERSIONS["@geekmidas/errors"],
 		"@geekmidas/auth": GEEKMIDAS_VERSIONS["@geekmidas/auth"],
 		"@hono/node-server": "~1.14.1",
-		hono: "~4.8.2",
-		pino: "~9.6.0",
-		zod: "~4.1.0"
+		hono: DEPENDENCY_VERSIONS.hono,
+		pino: DEPENDENCY_VERSIONS.pino,
+		zod: DEPENDENCY_VERSIONS.zod
 	},
 	devDependencies: {
 		"@biomejs/biome": "~2.3.0",
@@ -9926,10 +10142,10 @@ const apiTemplate = {
 	},
 	files: (options) => {
 		const { loggerType, routesStructure, monorepo, name: name$1, services } = options;
-		const bucket = storageFor(name$1);
-		const kv = cacheFor(name$1);
-		const db = databaseFor(name$1);
-		const mail = emailFor(name$1);
+		const bucket = storageFor();
+		const kv = cacheFor();
+		const db = databaseFor();
+		const mail = emailFor();
 		const src = (path) => monorepo ? `~/${path}` : `./${path}`;
 		const declares = !monorepo;
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
@@ -9963,6 +10179,9 @@ export const logger = createLogger();
 import { logger } from '../config/logger.ts';
 
 export const api = new RestApi('Api', {
+  // The project is the app.
+  path: '.',
+
   // Typed out rather than omitted: an API that ships open because a field was
   // left off is the one default worth refusing to have.
   defaultAuthorizer: 'none',
@@ -9985,7 +10204,7 @@ export const envParser = new EnvironmentParser({ ...process.env, ...Credentials
 export const config = envParser
   .create((get) => ({
     nodeEnv: get('NODE_ENV').enum(['development', 'test', 'production']).default('development'),
-    stage: get('STAGE').enum(['development', 'staging', 'production']).default('development'),
+    stage: ${stageEnv(options.stages)},
   }))
   .parse();
 `
@@ -10137,7 +10356,7 @@ export const authService = {
           headers: { cookie },
         });
         if (!res.ok) return null;
-        return res.json();
+        return (await res.json()) as Session | null;
       },
     };
   },
@@ -10150,7 +10369,6 @@ export const authService = {
 import { api } from '${constructsImport("api")}';${options.database ? `
 import { database } from '${constructsImport("database")}';` : ""}
 import { authService, type Session } from './services/auth.ts';
-import { logger } from './config/logger.ts';
 
 /**
  * The shared endpoint factory — no session required.
@@ -10208,7 +10426,8 @@ import { database } from '${constructsImport("database")}';` : ""}
 export const router = api.endpoints${options.database ? ".database(database)" : ""};
 `
 		});
-		if (options.database && declares) files$1.push(...databaseFiles(name$1));
+		if (options.database && declares) files$1.push(...databaseFiles());
+		else if (options.database) files$1.push(usersMigration());
 		if (services.storage && declares) files$1.push({
 			path: "src/constructs/storage.ts",
 			content: `import { ObjectStorage } from '@geekmidas/constructs/object-storage';
@@ -10358,9 +10577,9 @@ const minimalTemplate = {
 		"@geekmidas/rate-limit": GEEKMIDAS_VERSIONS["@geekmidas/rate-limit"],
 		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
 		"@hono/node-server": "~1.14.1",
-		hono: "~4.8.2",
-		pino: "~9.6.0",
-		zod: "~4.1.0"
+		hono: DEPENDENCY_VERSIONS.hono,
+		pino: DEPENDENCY_VERSIONS.pino,
+		zod: DEPENDENCY_VERSIONS.zod
 	},
 	devDependencies: {
 		"@biomejs/biome": "~2.3.0",
@@ -10384,7 +10603,7 @@ const minimalTemplate = {
 	},
 	files: (options) => {
 		const { loggerType, routesStructure, name: name$1 } = options;
-		const db = databaseFor(name$1);
+		const db = databaseFor();
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
 export const logger = createLogger();
@@ -10404,6 +10623,9 @@ export const logger = createLogger();
 import { logger } from '../config/logger.ts';
 
 export const api = new RestApi('Api', {
+  // The project is the app.
+  path: '.',
+
   // Typed out rather than omitted: an API that ships open because a field was
   // left off is the one default worth refusing to have.
   defaultAuthorizer: 'none',
@@ -10426,7 +10648,7 @@ export const envParser = new EnvironmentParser({ ...process.env, ...Credentials
 export const config = envParser
   .create((get) => ({
     nodeEnv: get('NODE_ENV').enum(['development', 'test', 'production']).default('development'),
-    stage: get('STAGE').enum(['development', 'staging', 'production']).default('development'),
+    stage: ${stageEnv(options.stages)},
   }))
   .parse();
 `
@@ -10453,7 +10675,7 @@ export const healthEndpoint = api
 `
 			}
 		];
-		if (options.database) files$1.push(...databaseFiles(name$1));
+		if (options.database) files$1.push(...databaseFiles());
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
 			content: `import { Telescope } from '@geekmidas/telescope';
@@ -10517,8 +10739,8 @@ const serverlessTemplate = {
 		"@geekmidas/rate-limit": GEEKMIDAS_VERSIONS["@geekmidas/rate-limit"],
 		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
 		"@hono/node-server": "~1.14.1",
-		hono: "~4.8.2",
-		pino: "~9.6.0"
+		hono: DEPENDENCY_VERSIONS.hono,
+		pino: DEPENDENCY_VERSIONS.pino
 	},
 	devDependencies: {
 		"@biomejs/biome": "~2.3.0",
@@ -10561,6 +10783,9 @@ export const logger = createLogger();
 import { logger } from '../config/logger.ts';
 
 export const api = new RestApi('Api', {
+  // The project is the app.
+  path: '.',
+
   // Typed out rather than omitted: an API that ships open because a field was
   // left off is the one default worth refusing to have.
   defaultAuthorizer: 'none',
@@ -10583,7 +10808,7 @@ export const envParser = new EnvironmentParser({ ...process.env, ...Credentials
 export const config = envParser
   .create((get) => ({
     nodeEnv: get('NODE_ENV').enum(['development', 'test', 'production']).default('development'),
-    stage: get('STAGE').enum(['dev', 'staging', 'prod']).default('dev'),
+    stage: ${stageEnv(options.stages)},
   }))
   .parse();
 `
@@ -10633,7 +10858,7 @@ export const worker = new Worker('Jobs', { logger });
 `
 			}
 		];
-		if (options.database) files$1.push(...databaseFiles(name$1));
+		if (options.database) files$1.push(...databaseFiles());
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
 			content: `import { Telescope } from '@geekmidas/telescope';
@@ -10642,7 +10867,7 @@ import { InMemoryStorage } from '@geekmidas/telescope/storage/memory';
 // Note: For production Lambda, consider using a persistent storage
 export const telescope = new Telescope({
   storage: new InMemoryStorage({ maxEntries: 50 }),
-  enabled: process.env.STAGE === 'dev',
+  enabled: process.env.STAGE === '${options.stages.local}',
 });
 `
 		});
@@ -10678,7 +10903,7 @@ const workerTemplate = {
 		"@geekmidas/events": GEEKMIDAS_VERSIONS["@geekmidas/events"],
 		"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
 		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
-		pino: "~10.3.1"
+		pino: DEPENDENCY_VERSIONS.pino
 	},
 	devDependencies: {
 		"@biomejs/biome": "~2.3.0",
@@ -10726,7 +10951,7 @@ export const envParser = new EnvironmentParser({ ...process.env, ...Credentials
 export const config = envParser
   .create((get) => ({
     nodeEnv: get('NODE_ENV').enum(['development', 'test', 'production']).default('development'),
-    stage: get('STAGE').enum(['development', 'staging', 'production']).default('development'),
+    stage: ${stageEnv(options.stages)},
   }))
   .parse();
 `
@@ -10816,7 +11041,7 @@ export const cleanup = worker
   });
 `
 		});
-		if (options.database) files$1.push(...databaseFiles(name$1));
+		if (options.database) files$1.push(...databaseFiles());
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
 			content: `import { Telescope } from '@geekmidas/telescope';
@@ -10837,7 +11062,7 @@ export const telescope = new Telescope({
 /**
 * OpenAPI output path (fixed, not configurable)
 */
-const OPENAPI_OUTPUT_PATH$1 = "./.gkm/openapi.ts";
+const OPENAPI_OUTPUT_PATH$1 = "./.gkm/openapi/api.ts";
 /**
 * Endpoints output path (generated by gkm dev/build)
 */
@@ -10943,15 +11168,23 @@ const packageManagerChoices = [
 /**
 * Deploy target choices for prompts
 */
-const deployTargetChoices = [{
-	title: "Dokploy",
-	value: "dokploy",
-	description: "Deploy to Dokploy (Docker-based hosting)"
-}, {
-	title: "Configure later",
-	value: "none",
-	description: "Skip deployment setup for now"
-}];
+const deployTargetChoices = [
+	{
+		title: "Dokploy",
+		value: "dokploy",
+		description: "Deploy to Dokploy (Docker-based hosting)"
+	},
+	{
+		title: "AWS (SST)",
+		value: "sst",
+		description: "Deploy to your AWS account through SST"
+	},
+	{
+		title: "Configure later",
+		value: "none",
+		description: "Skip deployment setup for now"
+	}
+];
 /**
 * Services choices for multi-select prompt
 */
@@ -11044,12 +11277,12 @@ function generatePackageJson(options, template) {
 	if (declares && services.mail) dependencies$1["@geekmidas/emailkit"] = GEEKMIDAS_VERSIONS["@geekmidas/emailkit"];
 	if (database) {
 		dependencies$1["@geekmidas/db"] = GEEKMIDAS_VERSIONS["@geekmidas/db"];
-		dependencies$1.kysely = "~0.28.2";
-		dependencies$1.pg = "~8.16.0";
-		devDependencies$1["@types/pg"] = "~8.15.0";
+		dependencies$1.kysely = DEPENDENCY_VERSIONS.kysely;
+		dependencies$1.pg = DEPENDENCY_VERSIONS.pg;
+		devDependencies$1["@types/pg"] = "~8.23.1";
 		devDependencies$1["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
 		devDependencies$1["@faker-js/faker"] = "~9.8.0";
-		devDependencies$1["kysely-ctl"] = "~0.10.0";
+		devDependencies$1["kysely-ctl"] = DEPENDENCY_VERSIONS["kysely-ctl"];
 		devDependencies$1["vite-tsconfig-paths"] = "~5.1.0";
 	}
 	if (monorepo) {
@@ -11069,6 +11302,8 @@ function generatePackageJson(options, template) {
 		const appName = pathParts[pathParts.length - 1] || "api";
 		packageName = `@${name$1}/${appName}`;
 	}
+	dependencies$1["@geekmidas/client"] = GEEKMIDAS_VERSIONS["@geekmidas/client"];
+	dependencies$1["@tanstack/react-query"] = DEPENDENCY_VERSIONS["@tanstack/react-query"];
 	const packageJson = {
 		name: packageName,
 		version: "0.0.1",
@@ -11106,7 +11341,7 @@ function generateSourceFiles(options, template) {
 */
 function generateTestFiles(options, _template) {
 	if (!options.database) return [];
-	const db = databaseFor(options.name);
+	const db = databaseFor();
 	const declares = !options.monorepo;
 	const schema = declares ? "../src/constructs/database.ts" : "~/services/database.ts";
 	const runtimeUrl = declares ? db.urlKey : "DATABASE_URL";
@@ -11142,14 +11377,16 @@ import pg from 'pg';
 import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
 import type { Database } from '${schema}';
 
-const connection = new Kysely<Database>({
+const db = new Kysely<Database>({
   dialect: new PostgresDialect({
     pool: new pg.Pool({ connectionString: process.env.${runtimeUrl} }),
   }),
 });
 
 export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
-  connection,
+  // A function, or a construct: an instance is taken for a construct and has
+  // no service to register.
+  connection: () => db,
 });
 `
 		},
@@ -11234,10 +11471,10 @@ export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
 import { it } from './config.ts';
 
 describe('example', () => {
-  it('should have a working test setup', async ({ db }) => {
-    // db is a transaction-wrapped Kysely instance
-    // All changes are automatically rolled back after the test
-    expect(db).toBeDefined();
+  it('should have a working test setup', async ({ trx }) => {
+    // trx is a Kysely transaction; everything in it is rolled back after the
+    // test
+    expect(trx).toBeDefined();
   });
 });
 `
@@ -12488,8 +12725,8 @@ export const Alert: Story = {
   ),
 };
 `;
-	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button.tsx';
-export { Input } from './input.tsx';
+	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button/index.tsx';
+export { Input } from './input/index.tsx';
 export {
   Card,
   CardHeader,
@@ -12497,17 +12734,17 @@ export {
   CardTitle,
   CardDescription,
   CardContent,
-} from './card.tsx';
-export { Label } from './label.tsx';
-export { Badge, type BadgeProps, badgeVariants } from './badge.tsx';
-export { Separator } from './separator.tsx';
-export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs.tsx';
+} from './card/index.tsx';
+export { Label } from './label/index.tsx';
+export { Badge, type BadgeProps, badgeVariants } from './badge/index.tsx';
+export { Separator } from './separator/index.tsx';
+export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs/index.tsx';
 export {
   Tooltip,
   TooltipTrigger,
   TooltipContent,
   TooltipProvider,
-} from './tooltip.tsx';
+} from './tooltip/index.tsx';
 export {
   Dialog,
   DialogPortal,
@@ -12519,7 +12756,7 @@ export {
   DialogFooter,
   DialogTitle,
   DialogDescription,
-} from './dialog.tsx';
+} from './dialog/index.tsx';
 `;
 	const buttonIndexTsx = buttonTsx;
 	const inputIndexTsx = inputTsx;
@@ -12687,8 +12924,8 @@ function generateWebAppFiles(options) {
 			[uiPackage]: "workspace:*",
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
-			"@tanstack/react-query": "~5.80.0",
-			"better-auth": "~1.2.0",
+			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
+			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
 			next: "~16.1.0",
 			react: "~19.2.0",
 			"react-dom": "~19.2.0"
@@ -12744,7 +12981,7 @@ export default nextConfig;
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*", "../../packages/ui/src/*"],
-				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi.ts"],
+				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi/api.ts"],
 				[`${modelsPackage}`]: ["../../packages/models/src"],
 				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
 				[`${uiPackage}`]: ["../../packages/ui/src"],
@@ -12757,12 +12994,7 @@ export default nextConfig;
 			"**/*.tsx",
 			".next/types/**/*.ts"
 		],
-		exclude: ["node_modules"],
-		references: [
-			{ path: "../../apps/api" },
-			{ path: "../../packages/ui" },
-			{ path: "../../packages/models" }
-		]
+		exclude: ["node_modules"]
 	};
 	const queryClientTs = `import { QueryClient } from '@tanstack/react-query';
 
@@ -13025,10 +13257,10 @@ function generateTanStackWebFiles(options) {
 			[uiPackage]: "workspace:*",
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
-			"@tanstack/react-query": "~5.80.0",
+			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
 			"@tanstack/react-router": "^1.87.0",
 			"@tanstack/react-start": "^1.87.0",
-			"better-auth": "~1.2.0",
+			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
 			react: "~19.2.0",
 			"react-dom": "~19.2.0"
 		},
@@ -13096,7 +13328,7 @@ export default defineConfig({
 				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
 				[uiPackage]: ["../../packages/ui/src"],
 				[`${uiPackage}/*`]: ["../../packages/ui/src/*"],
-				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi.ts"]
+				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi/api.ts"]
 			}
 		},
 		include: [
@@ -13386,12 +13618,27 @@ function detectPackageManager(cwd = process.cwd()) {
 	if (userAgent.includes("bun")) return "bun";
 	return "npm";
 }
+/** `gkm init`'s flags, which a name can swallow when a space goes missing. */
+const INIT_FLAGS = [
+	"yes",
+	"name",
+	"template",
+	"monorepo",
+	"api-path",
+	"pm",
+	"skip-install"
+];
 /**
 * Validate project name for npm package naming conventions
 */
 function validateProjectName(name$1) {
 	if (!name$1) return "Project name is required";
 	if (!/^[a-z0-9-_@/.]+$/i.test(name$1)) return "Project name can only contain letters, numbers, hyphens, underscores, @, /, and .";
+	const flag = name$1.match(/--(\w[\w-]*)$/)?.[1];
+	if (flag && INIT_FLAGS.includes(flag)) {
+		const intended = name$1.slice(0, -(flag.length + 2));
+		return `"${name$1}" ends in the --${flag} flag. Did you mean \`${intended} --${flag}\`?`;
+	}
 	const reserved = [
 		"node_modules",
 		".git",
@@ -13431,6 +13678,18 @@ function getRunCommand(pkgManager, script) {
 		default: return `npm run ${script}`;
 	}
 }
+/**
+* Run a binary the project installed, through its package manager — so it is
+* the project's own version, not whatever \`npx\` would fetch.
+*/
+function getExecCommand(pkgManager, command) {
+	switch (pkgManager) {
+		case "pnpm": return `pnpm exec ${command}`;
+		case "yarn": return `yarn ${command}`;
+		case "bun": return `bunx ${command}`;
+		default: return `npx --no-install ${command}`;
+	}
+}
 const lockfileByPm = {
 	pnpm: "pnpm-lock.yaml",
 	yarn: "yarn.lock",
@@ -13501,12 +13760,31 @@ function findWorkspacePackages(cwd, pm) {
 
 //#endregion
 //#region src/init/index.ts
+/** `' staging, prod '` → `['staging', 'prod']`. */
+const stageList = (value) => value.split(",").map((name$1) => name$1.trim()).filter(Boolean);
+/** `eu-west-1`, `us-gov-west-1`, `ap-southeast-2`. */
+const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 /**
 * Main init command - scaffolds a new project
 */
 async function initCommand(projectName, options = {}) {
 	const cwd = process.cwd();
 	const detectedPkgManager = detectPackageManager(cwd);
+	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new Error(`Unknown deploy target "${options.deploy}". Use ${deployTargetChoices.map((c) => c.value).join(", ")}.`);
+	if (options.region && !AWS_REGION.test(options.region)) throw new Error(`"${options.region}" is not an AWS region. Use one like eu-west-1.`);
+	if (options.stages || options.localStage || options.protectedStage) {
+		const deployed = stageList(options.stages ?? "");
+		const problems = [
+			...deployedProblems(deployed),
+			...options.localStage ? stageProblems({
+				local: options.localStage,
+				deployed
+			}) : [],
+			...options.protectedStage && !deployed.includes(options.protectedStage) ? [`--protected-stage "${options.protectedStage}" is not in --stages`] : []
+		];
+		if (problems.length) throw new Error([...new Set(problems)].join("\n"));
+	}
+	let deployedSoFar = [];
 	prompts.override({});
 	const onCancel = () => {
 		process.exit(0);
@@ -13557,12 +13835,49 @@ async function initCommand(projectName, options = {}) {
 			initial: packageManagerChoices.findIndex((c) => c.value === detectedPkgManager)
 		},
 		{
-			type: options.yes ? null : "select",
+			type: options.yes || options.deploy ? null : "select",
 			name: "deployTarget",
 			message: "Deployment target:",
 			choices: deployTargetChoices,
 			initial: 0
 		},
+		{
+			type: (_prev, values) => !options.yes && !options.region && (options.deploy ?? values.deployTarget) === "sst" ? "text" : null,
+			name: "region",
+			message: "AWS region (e.g. eu-west-1):",
+			validate: (value) => AWS_REGION.test(value.trim()) || "An AWS region, like eu-west-1"
+		},
+		{
+			type: options.yes || options.stages ? null : "text",
+			name: "deployedStages",
+			message: "Deployed stages, comma-separated (e.g. staging, prod):",
+			validate: (value) => {
+				const deployed = stageList(value);
+				if (deployed.length === 0) return "At least one stage";
+				return deployedProblems(deployed)[0] ?? true;
+			}
+		},
+		{
+			type: (_prev, values) => options.yes || options.protectedStage ? null : stageList(options.stages ?? values.deployedStages ?? "").length > 1 ? "select" : null,
+			name: "protectedStage",
+			message: "Which one is production (retained and protected)?",
+			choices: (_prev, values) => stageList(options.stages ?? values.deployedStages ?? "").map((name$2) => ({
+				title: name$2,
+				value: name$2
+			}))
+		},
+		{
+			type: (_prev, values) => {
+				deployedSoFar = stageList(options.stages ?? values.deployedStages ?? "");
+				return options.yes || options.localStage ? null : "text";
+			},
+			name: "localStage",
+			message: "Local stage, what gkm dev runs as (e.g. dev):",
+			validate: (value) => stageProblems({
+				local: value.trim(),
+				deployed: deployedSoFar
+			})[0] ?? true
+		},
 		{
 			type: options.yes ? null : "confirm",
 			name: "telescope",
@@ -13628,7 +13943,7 @@ async function initCommand(projectName, options = {}) {
 	};
 	if (services.events === "pgboss") services.db = true;
 	const pkgManager = options.pm ? options.pm : options.yes ? "pnpm" : answers.packageManager ?? detectedPkgManager;
-	const deployTarget = options.yes ? "dokploy" : answers.deployTarget ?? "dokploy";
+	const deployTarget = options.deploy ?? (options.yes ? "none" : answers.deployTarget ?? "none");
 	const database = services.db;
 	const frontendFramework = isFullstack ? options.yes ? "nextjs" : answers.frontendFramework ?? "nextjs" : void 0;
 	const templateOptions = {
@@ -13643,6 +13958,8 @@ async function initCommand(projectName, options = {}) {
 		apiPath: monorepo ? options.apiPath ?? "apps/api" : "",
 		packageManager: pkgManager,
 		deployTarget,
+		stages: resolveStages(options, answers),
+		...deployTarget === "sst" ? { region: options.region ?? (options.yes ? "eu-west-1" : answers.region?.trim()) } : {},
 		services,
 		frontendFramework
 	};
@@ -13718,12 +14035,12 @@ async function initCommand(projectName, options = {}) {
 	if (services.mail) secretServices.push("mailpit");
 	if (services.events === "sns") secretServices.push("localstack");
 	if (services.events === "rabbitmq") secretServices.push("rabbitmq");
-	const devSecrets = createStageSecrets("development", secretServices, {
+	const local = templateOptions.stages.local;
+	const devSecrets = createStageSecrets(local, secretServices, {
 		projectName: name$1,
 		eventsBackend: services.events
 	});
 	const customSecrets = {
-		NODE_ENV: "development",
 		PORT: "3000",
 		LOG_LEVEL: "debug",
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -13743,8 +14060,8 @@ async function initCommand(projectName, options = {}) {
 	}
 	devSecrets.custom = customSecrets;
 	await writeStageSecrets(devSecrets, targetDir);
-	const keyPath = getKeyPath("development", name$1);
-	console.log(`  Secrets: .gkm/secrets/development.json (encrypted)`);
+	const keyPath = getKeyPath(local, name$1);
+	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
 		console.log("\n📦 Installing dependencies...\n");
@@ -13757,11 +14074,13 @@ async function initCommand(projectName, options = {}) {
 			console.error("Failed to install dependencies");
 		}
 		try {
-			execSync("npx @biomejs/biome format --write --unsafe .", {
+			execSync(getExecCommand(pkgManager, "biome check --write ."), {
 				cwd: targetDir,
 				stdio: "inherit"
 			});
-		} catch {}
+		} catch {
+			console.warn(`\n⚠️  Formatting did not finish cleanly. Run ${getRunCommand(pkgManager, "fmt")} to see why.`);
+		}
 	}
 	console.log("\n📦 Initializing git repository...\n");
 	try {
@@ -13833,19 +14152,46 @@ function printNextSteps(projectName, options, pkgManager) {
 		console.log(`  └── turbo.json        # Turbo config`);
 		console.log("");
 	}
+	const { local, deployed } = options.stages;
 	console.log("🔐 Secrets management:");
-	console.log(`  gkm secrets:show --stage development  # View secrets`);
-	console.log(`  gkm secrets:set KEY VALUE --stage development  # Add secret`);
-	console.log(`  gkm secrets:init --stage production  # Create production secrets`);
+	console.log(`  gkm secrets:show --stage ${local}  # View secrets`);
+	console.log(`  gkm secrets:set KEY VALUE --stage ${local}  # Add secret`);
+	for (const stage of deployed) console.log(`  gkm secrets:init --stage ${stage}  # Create ${stage} secrets`);
 	console.log("");
 	if (options.deployTarget === "dokploy") {
 		console.log("🚀 Deployment:");
-		console.log(`  ${getRunCommand(pkgManager, "deploy")}`);
+		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}`);
+		console.log("");
+	}
+	if (options.deployTarget === "sst") {
+		console.log("🚀 Deployment (AWS, through SST):");
+		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm build --provider aws, then sst deploy`);
+		console.log(`  Uses your AWS credentials, in ${options.region}.`);
+		if (options.services.mail) console.log("  Set MAIL_FROM to a sender verified in SES first.");
 		console.log("");
 	}
 	console.log("📚 Documentation: https://geekmidas.github.io/toolbox/");
 	console.log("");
 }
+/**
+* The stages the project declares, from the answers or the flags.
+*
+* `--yes` with no stage flags has nobody to ask and needs an answer, so it
+* takes `local`, and one deployed stage, `production`, that is protected.
+*/
+function resolveStages(options, answers) {
+	const deployed = stageList(options.stages ?? answers.deployedStages ?? (options.yes ? "production" : ""));
+	const kept = options.protectedStage ?? answers.protectedStage ?? (deployed.length === 1 || options.yes ? deployed[0] : void 0);
+	const local = (options.localStage ?? answers.localStage ?? (options.yes ? "local" : "")).trim();
+	const stages = {
+		local,
+		deployed,
+		...kept ? { protected: [kept] } : {}
+	};
+	const problems = stageProblems(stages);
+	if (problems.length) throw new Error(problems.join("\n"));
+	return stages;
+}
 
 //#endregion
 //#region src/secrets/index.ts
@@ -14056,19 +14402,20 @@ function maskUrl(url) {
 * Environment variables are sniffed to inject only what the app needs.
 */
 async function testCommand(options = {}) {
-	const stage = options.stage ?? "development";
 	const cwd = process.cwd();
+	const stage = options.stage ?? await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
+	if (!stage) throw new Error("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
 	if (autoSetup) {
-		const { ensureStageSecrets } = await import("./setup-DGIPd2fh.mjs");
+		const { ensureStageSecrets } = await import("./setup-BA8ciTPU.mjs");
 		const generated = await ensureStageSecrets(stage, cwd);
 		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const result = await prepareEntryCredentials({
-		stages: [stage],
+		stage,
 		startDocker: true,
 		secretsFileName: "test-secrets.json",
 		resolveDockerPorts: "full",
@@ -14296,7 +14643,7 @@ program.name("gkm").description("GeekMidas backend framework CLI").version(packa
 	const opts = program.opts();
 	if (opts.debug) enableDebug();
 });
-program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").action(async (name$1, options) => {
+program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").action(async (name$1, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -14316,7 +14663,7 @@ program.command("trust").description("Trust the local edge's certificate authori
 		process.exit(1);
 	}
 });
-program.command("setup").description("Reconcile declared constructs — containers, databases, buckets, secrets").option("--stage <stage>", "Stage name", "development").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").action(async (options) => {
+program.command("setup").description("Reconcile declared constructs — containers, databases, buckets, secrets").option("--stage <stage>", "Stage name (default: stages.local)").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -14388,7 +14735,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from", "development").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -14536,7 +14883,7 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
 		if (secrets) {
-			const { derivedContainers: derivedContainers$1 } = await import("./workspace-CnTqIlB3.mjs");
+			const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
 			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 			if (result) {
 				await writeStageSecrets$1(result.secrets, workspace.root);
@@ -14565,7 +14912,7 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-CnTqIlB3.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (result) {
 			secrets = result.secrets;
@@ -14579,7 +14926,7 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		process.exit(1);
 	}
 });
-program.command("secrets:reconcile").description("Backfill missing custom secrets from workspace config").option("--stage <stage>", "Stage name", "development").action(async (options) => {
+program.command("secrets:reconcile").description("Backfill missing custom secrets from workspace config").option("--stage <stage>", "Stage name (default: stages.local)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -14587,19 +14934,20 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
-		const secrets = await readStageSecrets$1(options.stage, workspace.root);
+		const stage = options.stage ?? workspace.stages.local;
+		const secrets = await readStageSecrets$1(stage, workspace.root);
 		if (!secrets) {
-			console.error(`No secrets found for stage "${options.stage}". Run "gkm secrets:init --stage ${options.stage}" first.`);
+			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-CnTqIlB3.mjs");
-		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
+		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, stage));
 		if (!result) {
-			console.log(`\n✓ Secrets for stage "${options.stage}" are up-to-date`);
+			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
 			return;
 		}
 		await writeStageSecrets$1(result.secrets, workspace.root);
-		console.log(`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${options.stage}":`);
+		console.log(`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${stage}":`);
 		for (const key of result.addedKeys) console.log(`    + ${key}`);
 	} catch (error) {
 		console.error(formatError(error));