@geekmidas/cli 10.0.0-alpha.75 → 10.0.0-alpha.77

package/dist/index.mjs

@@ -4,20 +4,20 @@ import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs"
 import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-C7NqCsQF.mjs";
+import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-QUTqYmVy.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $ as LOCAL_CA_PATH, Bt as loadSecretsForApp, Dt as eventsBackendFor, Et as cacheBackendFor, Ft as createCredentialsPreload, G as QueueGenerator, Gt as FileSecretsStore, H as WorkerGenerator, It as createEntryWrapper, J as backendsOf$1, Jt as projectKey, K as CronGenerator, Kt as getKeyPath, L as parseDevServices, Lt as findAvailablePort, Mt as fakeKey, Ot as providerOf, Pt as primaryPortKey, Rt as isPortAvailable, U as workerBundleName, Ut as secretsStoreFor, V as workerUnits, Vt as prepareEntryCredentials, W as workerEntryDir, X as derivedContainers, Y as constructGlobs, Z as reconcileWorkspace, Zt as deployIdentity, an as maskPassword, at as postgresDatabaseNames, cn as withCustomSecret, et as forgetState, jt as describeServices, q as FAKE_ENV, sn as toEmbeddableSecrets, st as quoteIdentifier, ut as pgClient, v as dockerCommand, zt as loadEnvFiles } from "./state-BrWIOce_.mjs";
+import { At as eventsBackendFor, Bt as findAvailablePort, Dt as imageBuildCredentials, Ft as fakeKey, G as workerEntryDir, H as workerUnits, Ht as loadEnvFiles, J as FAKE_ENV, K as QueueGenerator, Kt as secretsStoreFor, Lt as primaryPortKey, Ot as isImageBuild, Pt as describeServices, Q as reconcileWorkspace, Qt as projectKey, R as parseDevServices, Rt as createCredentialsPreload, U as WorkerGenerator, Ut as loadSecretsForApp, Vt as isPortAvailable, W as workerBundleName, Wt as prepareEntryCredentials, X as constructGlobs, Xt as getKeyPath, Y as backendsOf$1, Yt as FileSecretsStore, Z as derivedContainers, ct as quoteIdentifier, dn as toEmbeddableSecrets, dt as pgClient, et as LOCAL_CA_PATH, fn as withCustomSecret, jt as providerOf, kt as cacheBackendFor, ln as maskPassword, ot as postgresDatabaseNames, q as CronGenerator, tn as deployIdentity, tt as forgetState, y as dockerCommand, zt as createEntryWrapper } from "./stale-DGzpiN5S.mjs";
 import { i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DftalLYg.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-BmCvVyhq.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
 import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-Ch1rJitn.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as deploy$1 } from "./deploy-CuSsiFIc.mjs";
-import { a as stackOverrideFile, c as parseDigests, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as dockerCompose } from "./compose-DdH2JQJD.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-DR8AlRCk.mjs";
+import { t as deploy$1 } from "./deploy-Q6X6RXRG.mjs";
+import { a as stackOverrideFile, c as parseDigests, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as dockerCompose } from "./compose-IUuxRW0J.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-RH9F2ZEy.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-DLxCCatI.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-ZZoNskrr.mjs";
 import { createRequire } from "node:module";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.75";
+var version = "10.0.0-alpha.77";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -130,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-BmCvVyhq.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-DR8AlRCk.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -1527,10 +1527,10 @@ async function execCommand(commandArgs, options = {}) {
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
+	const { credentials, secretsJsonPath, appName } = isImageBuild() ? await imageBuildEntry(cwd) : await prepareEntryCredentials({ cwd });
 	if (appName) logger$6.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0 && !isImageBuild()) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = join(cwd, ".gkm");
 	await mkdir(preloadDir, { recursive: true });
 	const preloadPath = join(preloadDir, "credentials-preload.mjs");
@@ -1556,6 +1556,23 @@ async function execCommand(commandArgs, options = {}) {
 	});
 	if (exitCode !== 0) process.exit(exitCode);
 }
+/**
+* `gkm exec` inside an image build: the public values the Dockerfile's build
+* args set, written where the preload reads them. No workspace is loaded, no
+* secret read and no address resolved.
+*/
+async function imageBuildEntry(cwd) {
+	const credentials = imageBuildCredentials();
+	logger$6.log(`🐳 Image build: ${Object.keys(credentials).length} public value(s) from the build args`);
+	const dir = join(cwd, ".gkm");
+	await mkdir(dir, { recursive: true });
+	const secretsJsonPath = join(dir, "image-build-env.json");
+	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		secretsJsonPath
+	};
+}
 //#endregion
 //#region src/dev/index.ts
 const logger$5 = console;
@@ -1688,7 +1705,7 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
-	const appSecrets = await loadSecretsForApp(workspace ? await secretsStoreFor(workspace, config.stages.local) : new FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
+	const appSecrets = await loadSecretsForApp(workspace ? await secretsStoreFor(workspace, config.stages.local) : new FileSecretsStore(secretsRoot), config.stages.local);
 	if (workspace) {
 		const reconciled = await reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
@@ -2036,9 +2053,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BLL1RTAj.mjs");
+		const { prepareDevDatabases } = await import("./migrate-BUBsUiM3.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BLL1RTAj.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-BUBsUiM3.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3046,7 +3063,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-xjp5RwRS.mjs");
+			const { bundleServer } = await import("./bundler-DgO_EMVs.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3170,7 +3187,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-xjp5RwRS.mjs");
+		const { bundleServer } = await import("./bundler-DgO_EMVs.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3240,7 +3257,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-xjp5RwRS.mjs");
+			const { bundleServer } = await import("./bundler-DgO_EMVs.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -4010,13 +4027,6 @@ const SERVICE_DEFAULTS = {
 		region: "us-east-1"
 	}
 };
-/** Default credentials for pgboss (not a Docker service, reuses postgres) */
-const PGBOSS_DEFAULTS = {
-	host: "localhost",
-	port: 5432,
-	username: "pgboss",
-	database: "app"
-};
 /**
 * Generate credentials for a specific service.
 */
@@ -4056,14 +4066,6 @@ function generateMinioEndpoint(creds) {
 	return `http://${host}:${port}`;
 }
 /**
-* Generate connection URL for pg-boss (uses PostgreSQL protocol).
-* Format: pgboss://user:pass@host:port/db?schema=pgboss
-*/
-function generatePgBossUrl(creds) {
-	const { username, password, host, port, database } = creds;
-	return `pgboss://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=pgboss`;
-}
-/**
 * Generate connection URLs from service credentials.
 */
 function generateConnectionUrls(services) {
@@ -4071,7 +4073,6 @@ function generateConnectionUrls(services) {
 	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
 	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
 	if (services.minio) urls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);
-	if (services.pgboss) urls.EVENT_PUBLISHER_CONNECTION_STRING = generatePgBossUrl(services.pgboss);
 	if (services.mailpit) {
 		urls.SMTP_HOST = services.mailpit.host;
 		urls.SMTP_PORT = String(services.mailpit.port);
@@ -4095,13 +4096,6 @@ function createStageSecrets(stage, services, options) {
 			serviceCredentials.minio.username = options.projectName;
 		}
 	}
-	if (serviceCredentials.postgres && !serviceCredentials.pgboss) serviceCredentials.pgboss = {
-		...PGBOSS_DEFAULTS,
-		password: generateSecurePassword(),
-		host: serviceCredentials.postgres.host,
-		port: serviceCredentials.postgres.port,
-		database: serviceCredentials.postgres.database
-	};
 	return {
 		stage,
 		createdAt: now,
@@ -4964,25 +4958,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.75",
-	"@geekmidas/auth": "~10.0.0-alpha.75",
-	"@geekmidas/cache": "~10.0.0-alpha.75",
-	"@geekmidas/client": "~10.0.0-alpha.75",
-	"@geekmidas/cloud": "~10.0.0-alpha.75",
-	"@geekmidas/constructs": "~10.0.0-alpha.75",
-	"@geekmidas/db": "~10.0.0-alpha.75",
-	"@geekmidas/emailkit": "~10.0.0-alpha.75",
-	"@geekmidas/envkit": "~10.0.0-alpha.75",
-	"@geekmidas/errors": "~10.0.0-alpha.75",
-	"@geekmidas/events": "~10.0.0-alpha.75",
-	"@geekmidas/logger": "~10.0.0-alpha.75",
-	"@geekmidas/manifest": "~10.0.0-alpha.75",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.75",
-	"@geekmidas/schema": "~10.0.0-alpha.75",
-	"@geekmidas/services": "~10.0.0-alpha.75",
-	"@geekmidas/storage": "~10.0.0-alpha.75",
-	"@geekmidas/telescope": "~10.0.0-alpha.75",
-	"@geekmidas/testkit": "~10.0.0-alpha.75",
+	"@geekmidas/audit": "~10.0.0-alpha.77",
+	"@geekmidas/auth": "~10.0.0-alpha.77",
+	"@geekmidas/cache": "~10.0.0-alpha.77",
+	"@geekmidas/client": "~10.0.0-alpha.77",
+	"@geekmidas/cloud": "~10.0.0-alpha.77",
+	"@geekmidas/constructs": "~10.0.0-alpha.77",
+	"@geekmidas/db": "~10.0.0-alpha.77",
+	"@geekmidas/emailkit": "~10.0.0-alpha.77",
+	"@geekmidas/envkit": "~10.0.0-alpha.77",
+	"@geekmidas/errors": "~10.0.0-alpha.77",
+	"@geekmidas/events": "~10.0.0-alpha.77",
+	"@geekmidas/logger": "~10.0.0-alpha.77",
+	"@geekmidas/manifest": "~10.0.0-alpha.77",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.77",
+	"@geekmidas/schema": "~10.0.0-alpha.77",
+	"@geekmidas/services": "~10.0.0-alpha.77",
+	"@geekmidas/storage": "~10.0.0-alpha.77",
+	"@geekmidas/telescope": "~10.0.0-alpha.77",
+	"@geekmidas/testkit": "~10.0.0-alpha.77",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -6827,7 +6821,6 @@ docker-compose.constructs.yml
 .env
 .env.local
 .env.*.local
-docker/.env
 
 # IDE
 .idea/
@@ -7040,6 +7033,7 @@ function secretsStore(options) {
 	return `
     // Deployed stages keep their secrets in SSM, in the account each stage
     // deploys to: \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
+    // Past 8 KB a stage needs { provider: 'secrets-manager', region } instead.
     store: { provider: 'ssm', region: '${options.region}' },`;
 }
 /**
@@ -9895,7 +9889,6 @@ async function initCommand(projectName, options = {}) {
 	};
 	if (isFullstack) {
 		customSecrets.AUTH_PORT = "3002";
-		customSecrets.AUTH_URL = "http://localhost:3002";
 		customSecrets.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${Math.random().toString(36).slice(2)}`;
 		customSecrets.BETTER_AUTH_URL = "http://localhost:3002";
 		customSecrets.BETTER_AUTH_TRUSTED_ORIGINS = "http://localhost:3000,http://localhost:3001";
@@ -10059,27 +10052,18 @@ var NotAnAwsRegion = class extends Error {
 //#endregion
 //#region src/setup/fullstack-secrets.ts
 /**
-* Generate a secure random password for database users.
-* Uses a combination of timestamp and random bytes for uniqueness.
-*/
-function generateDbPassword() {
-	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
-}
-/**
-* Generate database URL for an app.
-* All apps connect to the same database, but use different users/schemas.
-*/
-function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
-	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
-}
-/**
 * Generate fullstack-aware custom secrets for a workspace.
 *
 * Generates:
 * - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
 *   decides that; see `gkm init`)
-* - Per-app database passwords and URLs for backend apps with db service
 * - Better-auth secrets for apps using the better-auth framework
+*
+* No address of anything a construct declares — a database's or a tenant's
+* URL, a surface's or a site's. Those are derived from the construct, with
+* passwords from the stage, and one stored here would be a value set by hand,
+* which wins over the derived one: a `localhost` URL handed to a container,
+* with a password no role has.
 */
 function generateFullstackCustomSecrets(workspace, containers = []) {
 	const hasDb = containers.includes("postgres");
@@ -10089,22 +10073,10 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
 	};
 	if (!hasDb) return customs;
-	const frontendPorts = [];
-	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
-		if (appConfig.type === "web") {
-			frontendPorts.push(appConfig.port);
-			const upperName = appName.toUpperCase();
-			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
-			continue;
-		}
-		if (appConfig.type === "mobile") continue;
-		const password = generateDbPassword();
-		const upperName = appName.toUpperCase();
-		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
-		customs[`${upperName}_DB_PASSWORD`] = password;
+	for (const appConfig of Object.values(workspace.apps)) {
+		if (appConfig.type === "web" || appConfig.type === "mobile") continue;
 		if (appConfig.framework === "better-auth") {
 			customs.AUTH_PORT = String(appConfig.port);
-			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
 			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;
 			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
 		}
@@ -10112,31 +10084,12 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
 	return customs;
 }
-/**
-* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
-*
-* The docker/.env file contains database passwords that the PostgreSQL
-* init script reads to create per-app database users.
-*/
-async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
-	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
-	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
-	if (dbPasswordEntries.length === 0) return;
-	const envContent = `# Auto-generated docker environment file
-# Contains database passwords for docker-compose postgres init
-# This file is gitignored - do not commit to version control
-${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
-`;
-	const envPath = join(workspaceRoot, "docker", ".env");
-	await mkdir(dirname(envPath), { recursive: true });
-	await writeFile(envPath, envContent);
-}
 //#endregion
 //#region src/secrets/index.ts
 const logger$2 = console;
 /**
-* The store the stage named on the command line keeps its secrets in — SSM in
-* its account, for a deployed stage kept there. Outside any workspace nothing
+* The store the stage named on the command line keeps its secrets in — SSM or
+* Secrets Manager in its account, for a deployed stage kept there. Outside any workspace nothing
 * names a store, so it is the file.
 */
 async function storeFor(stage) {
@@ -10217,6 +10170,47 @@ async function secretsSetCommand(key, value, options) {
 	await store.write(stage, withCustomSecret(secrets, key, secretValue));
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
+/** `gkm secrets:unset` for a key the stage does not hold. */
+var SecretNotSet = class extends Error {
+	key;
+	stage;
+	constructor(key, stage) {
+		super(`The stage '${stage}' holds no secret '${key}'. List what it holds with gkm secrets:show --stage ${stage}.`);
+		this.key = key;
+		this.stage = stage;
+		this.name = "SecretNotSet";
+	}
+};
+/** `gkm secrets:unset` on a stage that has no secrets at all. */
+var StageSecretsNotFound = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no secrets, so there is nothing to remove.`);
+		this.stage = stage;
+		this.name = "StageSecretsNotFound";
+	}
+};
+/**
+* Remove a custom secret from a stage, in the stage's own store — the file,
+* SSM or Secrets Manager. The rest of the stage is written back as it was.
+*
+* @throws {StageSecretsNotFound} when the stage holds no secrets
+* @throws {SecretNotSet} when it holds none by that key
+*/
+async function secretsUnsetCommand(key, options) {
+	const { stage } = options;
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
+	if (!secrets) throw new StageSecretsNotFound(stage);
+	if (!(key in secrets.custom)) throw new SecretNotSet(key, stage);
+	const { [key]: _removed, ...custom } = secrets.custom;
+	await store.write(stage, {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom
+	});
+	logger$2.log(`\n✓ Secret "${key}" removed from stage "${stage}" (${store.name})`);
+}
 /**
 * A third party's credentials, checked against the schema of the construct
 * that reads them before they are stored — what the app would otherwise
@@ -10372,9 +10366,8 @@ const logger$1 = console;
 *
 * Orchestrates:
 * 1. Load workspace config
-* 2. Resolve secrets (local → SSM → generate fresh)
-* 3. Write docker/.env from secrets
-* 4. Start Docker services
+* 2. Resolve secrets (local → the stage's store → generate fresh)
+* 3. Start Docker services
 */
 async function setupCommand(options = {}) {
 	logger$1.log("\n🔧 Setting up the local environment...\n");
@@ -10387,20 +10380,13 @@ async function setupCommand(options = {}) {
 	}
 	const stage = options.stage ?? loadedConfig.workspace.stages.local;
 	const { workspace } = loadedConfig;
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
-	const secrets = await resolveSecrets(stage, workspace, options);
-	if (!secrets) {
+	if (!await resolveSecrets(stage, workspace, options)) {
 		logger$1.error("❌ Failed to resolve secrets. Exiting.");
 		process.exit(1);
 	}
-	const containers = await derivedContainers(workspace, stage);
-	if (isMultiApp && containers.includes("postgres")) {
-		await writeDockerEnvFromSecrets(secrets, workspace.root);
-		logger$1.log("📄 Generated docker/.env with database passwords");
-	}
 	if (!options.skipDocker) {
 		logger$1.log("");
 		await reconcileLocal(workspace, stage, options);
@@ -10497,24 +10483,6 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 		logger$1.log(`   🔄 Adding missing service credentials: ${name}`);
 		changed = true;
 	}
-	if (result.services.postgres && !result.services.pgboss) {
-		result = {
-			...result,
-			services: {
-				...result.services,
-				pgboss: {
-					host: result.services.postgres.host,
-					port: result.services.postgres.port,
-					username: "pgboss",
-					password: generateSecurePassword(),
-					database: result.services.postgres.database ?? "app"
-				}
-			}
-		};
-		result.urls = generateConnectionUrls(result.services);
-		logger$1.log("   🔄 Adding missing service credentials: pgboss");
-		changed = true;
-	}
 	if (Object.keys(workspace.apps).length > 1) {
 		const expected = generateFullstackCustomSecrets(workspace, containers);
 		const missing = {};
@@ -10540,7 +10508,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 /**
 * Build a fresh StageSecrets object for a workspace: service credentials,
 * connection URLs, and custom secrets. Pure — does not write to disk or touch
-* SSM. Service passwords are freshly randomized, so the result must be the same
+* any store. Service passwords are freshly randomized, so the result must be the same
 * one used to start the matching Docker containers.
 * @internal Exported for reuse by `gkm test` auto-setup.
 */
@@ -10773,7 +10741,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BLL1RTAj.mjs");
+	const { migrateAndSeed } = await import("./migrate-BUBsUiM3.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11206,7 +11174,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BLL1RTAj.mjs");
+		const { migrateCommand } = await import("./migrate-BUBsUiM3.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11220,7 +11188,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BLL1RTAj.mjs");
+		const { seedCommand } = await import("./migrate-BUBsUiM3.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11234,7 +11202,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BLL1RTAj.mjs");
+		const { migrationCommand } = await import("./migrate-BUBsUiM3.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11324,11 +11292,21 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("secrets:unset").description("Remove a custom secret from a stage").argument("<key>", "Secret key (e.g., API_KEY)").requiredOption("--stage <stage>", "Stage name").action(async (key, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsUnsetCommand(key, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("secrets:add").description("Build the keys a stage must be given — buckets, mail, file servers, third parties' credentials — across every app").requiredOption("--stage <stage>", "Stage name").option("--missing", "Only the keys the stage has not set").option("--json", "Print the keys as JSON and ask nothing").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-Cvzdw8cf.mjs");
+		const { secretsAddCommand } = await import("./add-EPQO-_dt.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11339,7 +11317,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-JkeMPugf.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-D4Ykywfr.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11350,7 +11328,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-JkeMPugf.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-D4Ykywfr.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11393,7 +11371,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./state-BrWIOce_.mjs").then((n) => n.Wt);
+		const { secretsStoreFor } = await import("./stale-DGzpiN5S.mjs").then((n) => n.Jt);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11402,7 +11380,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./state-BrWIOce_.mjs").then((n) => n.Q);
+		const { derivedContainers } = await import("./stale-DGzpiN5S.mjs").then((n) => n.$);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11416,8 +11394,19 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
+program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (file, ssm, secrets-manager)").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "file, ssm or secrets-manager").option("--region <region>", "The target's AWS region (default: the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace a stage the target already holds").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { secretsMigrateCommand } = await import("./migrate-DWVl5PQK.mjs");
+		await secretsMigrateCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-BTGfA0B7.mjs");
+	const { deployCli } = await import("./cli-B74Ru-V1.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11434,7 +11423,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-CLi5Pln_.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-sg0ZhKGG.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11470,7 +11459,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BNngHoId.mjs");
+		const { deployGithubCommand } = await import("./github-BBIqk1Jv.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));