@geekmidas/cli 9.0.2 → 10.0.0-alpha.0

package/dist/setup-WZ-xqAQO.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup-WZ-xqAQO.cjs","names":["logger","envConfig: string | string[] | undefined","cwd: string","loaded: string[]","missing: string[]","port: number","resolve","err: NodeJS.ErrnoException","preferredPort: number","composePath: string","results: ComposePortMapping[]","workspaceRoot: string","ports: PortState","service: string","containerPort: number","dockerEnv: Record<string, string>","url: string","oldPort: number","newPort: number","secrets: Record<string, string>","resolvedPorts: ResolvedServicePorts","portReplacements: { defaultPort: number; resolvedPort: number }[]","secretsEnv?: Record<string, string>","portEnv?: Record<string, string>","workspace: { root: string; apps: Record<string, unknown> }","secretsRoot: string","appName?: string","stages: string[]","startDir: string","secretsJsonPath: string","preloadPath: string","wrapperPath: string","entryPath: string","secretsJsonPath?: string","options: {\n\texplicitPort?: number;\n\tcwd?: string;\n\tresolveDockerPorts?: 'full' | 'readonly';\n\t/** Secret stages to try, in order. Default: ['dev', 'development'] */\n\tstages?: string[];\n\t/** Start Docker Compose services after port resolution. Default: false */\n\tstartDocker?: boolean;\n\t/** Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json' */\n\tsecretsFileName?: string;\n}","workspaceAppPort: number | undefined","appName: string | undefined","appInfo: WorkspaceAppInfo | undefined","options: SetupOptions","loadedConfig: LoadedConfig","stage: string","workspace: NormalizedWorkspace","secrets: StageSecrets","serviceMap: {\n\t\tkey: keyof typeof workspace.services;\n\t\tname: ComposeServiceName;\n\t}[]","missing: Record<string, string>","serviceNames: ComposeServiceName[]","cwd: string"],"sources":["../src/credentials/index.ts","../src/setup/index.ts"],"sourcesContent":["import { execSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { createServer } from 'node:net';\nimport { dirname, join, resolve } from 'node:path';\nimport { config as dotenvConfig } from 'dotenv';\nimport { parse as parseYaml } from 'yaml';\nimport {\n\tgetAppNameFromCwd,\n\tloadWorkspaceAppInfo,\n\ttype WorkspaceAppInfo,\n} from '../config';\nimport { generatePgBossUrl } from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\ttoEmbeddableSecrets,\n} from '../secrets/storage.js';\nimport { getDependencyEnvVars } from '../workspace/index.js';\n\nconst logger = console;\n\n// ---------------------------------------------------------------------------\n// Environment files\n// ---------------------------------------------------------------------------\n\n/**\n * Load environment files\n * @internal Exported for testing\n */\nexport function loadEnvFiles(\n\tenvConfig: string | string[] | undefined,\n\tcwd: string = process.cwd(),\n): { loaded: string[]; missing: string[] } {\n\tconst loaded: string[] = [];\n\tconst missing: string[] = [];\n\n\t// Normalize to array\n\tconst envFiles = envConfig\n\t\t? Array.isArray(envConfig)\n\t\t\t? envConfig\n\t\t\t: [envConfig]\n\t\t: ['.env'];\n\n\t// Load each env file in order (later files override earlier)\n\tfor (const envFile of envFiles) {\n\t\tconst envPath = resolve(cwd, envFile);\n\t\tif (existsSync(envPath)) {\n\t\t\tdotenvConfig({ path: envPath, override: true, quiet: true });\n\t\t\tloaded.push(envFile);\n\t\t} else if (envConfig) {\n\t\t\t// Only report as missing if explicitly configured\n\t\t\tmissing.push(envFile);\n\t\t}\n\t}\n\n\treturn { loaded, missing };\n}\n\n// ---------------------------------------------------------------------------\n// Port utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Check if a port is available\n * @internal Exported for testing\n */\nexport async function isPortAvailable(port: number): Promise<boolean> {\n\treturn new Promise((resolve) => {\n\t\tconst server = createServer();\n\n\t\tserver.once('error', (err: NodeJS.ErrnoException) => {\n\t\t\tif (err.code === 'EADDRINUSE') {\n\t\t\t\tresolve(false);\n\t\t\t} else {\n\t\t\t\tresolve(false);\n\t\t\t}\n\t\t});\n\n\t\tserver.once('listening', () => {\n\t\t\tserver.close();\n\t\t\tresolve(true);\n\t\t});\n\n\t\tserver.listen(port);\n\t});\n}\n\n/**\n * Find an available port starting from the preferred port\n * @internal Exported for testing\n */\nexport async function findAvailablePort(\n\tpreferredPort: number,\n\tmaxAttempts = 10,\n): Promise<number> {\n\tfor (let i = 0; i < maxAttempts; i++) {\n\t\tconst port = preferredPort + i;\n\t\tif (await isPortAvailable(port)) {\n\t\t\treturn port;\n\t\t}\n\t\tlogger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);\n\t}\n\n\tthrow new Error(\n\t\t`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`,\n\t);\n}\n\n// ---------------------------------------------------------------------------\n// Docker Compose port mapping\n// ---------------------------------------------------------------------------\n\n/**\n * A port mapping extracted from docker-compose.yml.\n * Only entries using env var interpolation (e.g., `${VAR:-default}:container`) are captured.\n */\nexport interface ComposePortMapping {\n\tservice: string;\n\tenvVar: string;\n\tdefaultPort: number;\n\tcontainerPort: number;\n}\n\n/** Port state persisted to .gkm/ports.json, keyed by env var name. */\nexport type PortState = Record<string, number>;\n\nexport interface ResolvedServicePorts {\n\tdockerEnv: Record<string, string>;\n\tports: PortState;\n\tmappings: ComposePortMapping[];\n}\n\nconst PORT_STATE_PATH = '.gkm/ports.json';\n\n/**\n * Parse docker-compose.yml and extract all port mappings that use env var interpolation.\n * Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.\n * Fixed port mappings like `'5050:80'` are skipped.\n * @internal Exported for testing\n */\nexport function parseComposePortMappings(\n\tcomposePath: string,\n): ComposePortMapping[] {\n\tif (!existsSync(composePath)) {\n\t\treturn [];\n\t}\n\n\tconst content = readFileSync(composePath, 'utf-8');\n\tconst compose = parseYaml(content) as {\n\t\tservices?: Record<string, { ports?: string[] }>;\n\t};\n\n\tif (!compose?.services) {\n\t\treturn [];\n\t}\n\n\tconst results: ComposePortMapping[] = [];\n\n\tfor (const [serviceName, serviceConfig] of Object.entries(compose.services)) {\n\t\tfor (const portMapping of serviceConfig?.ports ?? []) {\n\t\t\tconst match = String(portMapping).match(/\\$\\{(\\w+):-(\\d+)\\}:(\\d+)/);\n\t\t\tif (match?.[1] && match[2] && match[3]) {\n\t\t\t\tresults.push({\n\t\t\t\t\tservice: serviceName,\n\t\t\t\t\tenvVar: match[1],\n\t\t\t\t\tdefaultPort: Number(match[2]),\n\t\t\t\t\tcontainerPort: Number(match[3]),\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n\n\treturn results;\n}\n\n/**\n * Load saved port state from .gkm/ports.json.\n * @internal Exported for testing\n */\nexport async function loadPortState(workspaceRoot: string): Promise<PortState> {\n\ttry {\n\t\tconst raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), 'utf-8');\n\t\treturn JSON.parse(raw) as PortState;\n\t} catch {\n\t\treturn {};\n\t}\n}\n\n/**\n * Save port state to .gkm/ports.json.\n * @internal Exported for testing\n */\nexport async function savePortState(\n\tworkspaceRoot: string,\n\tports: PortState,\n): Promise<void> {\n\tconst dir = join(workspaceRoot, '.gkm');\n\tawait mkdir(dir, { recursive: true });\n\tawait writeFile(\n\t\tjoin(workspaceRoot, PORT_STATE_PATH),\n\t\t`${JSON.stringify(ports, null, 2)}\\n`,\n\t);\n}\n\n/**\n * Check if a project's own Docker container is running and return its host port.\n * Uses `docker compose port` scoped to the project's compose file.\n * @internal Exported for testing\n */\nexport function getContainerHostPort(\n\tworkspaceRoot: string,\n\tservice: string,\n\tcontainerPort: number,\n): number | null {\n\ttry {\n\t\tconst result = execSync(`docker compose port ${service} ${containerPort}`, {\n\t\t\tcwd: workspaceRoot,\n\t\t\tstdio: 'pipe',\n\t\t})\n\t\t\t.toString()\n\t\t\t.trim();\n\t\tconst match = result.match(/:(\\d+)$/);\n\t\treturn match ? Number(match[1]) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Resolve host ports for Docker services by parsing docker-compose.yml.\n * Priority: running container → saved state → find available port.\n * Persists resolved ports to .gkm/ports.json.\n * @internal Exported for testing\n */\nexport async function resolveServicePorts(\n\tworkspaceRoot: string,\n): Promise<ResolvedServicePorts> {\n\tconst composePath = join(workspaceRoot, 'docker-compose.yml');\n\tconst mappings = parseComposePortMappings(composePath);\n\n\tif (mappings.length === 0) {\n\t\treturn { dockerEnv: {}, ports: {}, mappings: [] };\n\t}\n\n\tconst savedState = await loadPortState(workspaceRoot);\n\tconst dockerEnv: Record<string, string> = {};\n\tconst ports: PortState = {};\n\t// Track ports assigned in this cycle to avoid duplicates\n\tconst assignedPorts = new Set<number>();\n\n\tlogger.log('\\n🔌 Resolving service ports...');\n\n\tfor (const mapping of mappings) {\n\t\t// 1. Check if own container is already running\n\t\tconst containerPort = getContainerHostPort(\n\t\t\tworkspaceRoot,\n\t\t\tmapping.service,\n\t\t\tmapping.containerPort,\n\t\t);\n\t\tif (containerPort !== null) {\n\t\t\tports[mapping.envVar] = containerPort;\n\t\t\tdockerEnv[mapping.envVar] = String(containerPort);\n\t\t\tassignedPorts.add(containerPort);\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\n\t\t// 2. Check saved port state\n\t\tconst savedPort = savedState[mapping.envVar];\n\t\tif (\n\t\t\tsavedPort &&\n\t\t\t!assignedPorts.has(savedPort) &&\n\t\t\t(await isPortAvailable(savedPort))\n\t\t) {\n\t\t\tports[mapping.envVar] = savedPort;\n\t\t\tdockerEnv[mapping.envVar] = String(savedPort);\n\t\t\tassignedPorts.add(savedPort);\n\t\t\tlogger.log(\n\t\t\t\t`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\n\t\t// 3. Find available port (skipping ports already assigned this cycle)\n\t\tlet resolvedPort = await findAvailablePort(mapping.defaultPort);\n\t\twhile (assignedPorts.has(resolvedPort)) {\n\t\t\tresolvedPort = await findAvailablePort(resolvedPort + 1);\n\t\t}\n\t\tports[mapping.envVar] = resolvedPort;\n\t\tdockerEnv[mapping.envVar] = String(resolvedPort);\n\t\tassignedPorts.add(resolvedPort);\n\n\t\tif (resolvedPort !== mapping.defaultPort) {\n\t\t\tlogger.log(\n\t\t\t\t`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`,\n\t\t\t);\n\t\t} else {\n\t\t\tlogger.log(\n\t\t\t\t`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`,\n\t\t\t);\n\t\t}\n\t}\n\n\tawait savePortState(workspaceRoot, ports);\n\n\treturn { dockerEnv, ports, mappings };\n}\n\n// ---------------------------------------------------------------------------\n// URL rewriting\n// ---------------------------------------------------------------------------\n\n/**\n * Replace a port in a URL string.\n * Handles both `hostname:port` and `localhost:port` patterns.\n * @internal Exported for testing\n */\nexport function replacePortInUrl(\n\turl: string,\n\toldPort: number,\n\tnewPort: number,\n): string {\n\tif (oldPort === newPort) return url;\n\t// Replace literal :port (in authority section)\n\tlet result = url.replace(\n\t\tnew RegExp(`:${oldPort}(?=[/?#]|$)`, 'g'),\n\t\t`:${newPort}`,\n\t);\n\t// Replace URL-encoded :port (e.g., in query params like endpoint=http%3A%2F%2Flocalhost%3A4566)\n\tresult = result.replace(\n\t\tnew RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, 'gi'),\n\t\t`%3A${newPort}`,\n\t);\n\treturn result;\n}\n\n/**\n * Rewrite connection URLs and port vars in secrets with resolved ports.\n * Uses the parsed compose mappings to determine which default ports to replace.\n * Pure transform — does not modify secrets on disk.\n * @internal Exported for testing\n */\nexport function rewriteUrlsWithPorts(\n\tsecrets: Record<string, string>,\n\tresolvedPorts: ResolvedServicePorts,\n): Record<string, string> {\n\tconst { ports, mappings } = resolvedPorts;\n\tconst result = { ...secrets };\n\n\t// Build a map of defaultPort → resolvedPort for all changed ports\n\tconst portReplacements: { defaultPort: number; resolvedPort: number }[] = [];\n\t// Collect Docker service names for hostname rewriting\n\tconst serviceNames = new Set<string>();\n\tfor (const mapping of mappings) {\n\t\tserviceNames.add(mapping.service);\n\t\tconst resolved = ports[mapping.envVar];\n\t\tif (resolved !== undefined) {\n\t\t\tportReplacements.push({\n\t\t\t\tdefaultPort: mapping.defaultPort,\n\t\t\t\tresolvedPort: resolved,\n\t\t\t});\n\t\t}\n\t}\n\n\t// Rewrite _HOST env vars that use Docker service names\n\tfor (const [key, value] of Object.entries(result)) {\n\t\tif (!key.endsWith('_HOST')) continue;\n\t\tif (serviceNames.has(value)) {\n\t\t\tresult[key] = 'localhost';\n\t\t}\n\t}\n\n\t// Rewrite _PORT env vars whose values match a default port\n\tfor (const [key, value] of Object.entries(result)) {\n\t\tif (!key.endsWith('_PORT')) continue;\n\t\tfor (const { defaultPort, resolvedPort } of portReplacements) {\n\t\t\tif (value === String(defaultPort)) {\n\t\t\t\tresult[key] = String(resolvedPort);\n\t\t\t}\n\t\t}\n\t}\n\n\t// Rewrite URLs: replace Docker service hostnames with localhost and fix ports\n\tfor (const [key, value] of Object.entries(result)) {\n\t\tif (\n\t\t\t!key.endsWith('_URL') &&\n\t\t\t!key.endsWith('_ENDPOINT') &&\n\t\t\t!key.endsWith('_CONNECTION_STRING') &&\n\t\t\tkey !== 'DATABASE_URL'\n\t\t)\n\t\t\tcontinue;\n\n\t\tlet rewritten = value;\n\t\tfor (const name of serviceNames) {\n\t\t\trewritten = rewritten.replace(\n\t\t\t\tnew RegExp(`@${name}:`, 'g'),\n\t\t\t\t'@localhost:',\n\t\t\t);\n\t\t}\n\t\tfor (const { defaultPort, resolvedPort } of portReplacements) {\n\t\t\trewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);\n\t\t}\n\t\tresult[key] = rewritten;\n\t}\n\n\treturn result;\n}\n\n// ---------------------------------------------------------------------------\n// Docker Compose services\n// ---------------------------------------------------------------------------\n\n/**\n * Build the environment variables to pass to `docker compose up`.\n * Merges process.env, secrets, and port mappings so that Docker Compose\n * can interpolate variables like ${POSTGRES_USER} correctly.\n * @internal Exported for testing\n */\nexport function buildDockerComposeEnv(\n\tsecretsEnv?: Record<string, string>,\n\tportEnv?: Record<string, string>,\n): Record<string, string | undefined> {\n\treturn { ...process.env, ...secretsEnv, ...portEnv };\n}\n\n/**\n * Parse all service names from a docker-compose.yml file.\n * @internal Exported for testing\n */\nexport function parseComposeServiceNames(composePath: string): string[] {\n\tif (!existsSync(composePath)) {\n\t\treturn [];\n\t}\n\n\tconst content = readFileSync(composePath, 'utf-8');\n\tconst compose = parseYaml(content) as {\n\t\tservices?: Record<string, unknown>;\n\t};\n\n\treturn Object.keys(compose?.services ?? {});\n}\n\n/**\n * Start docker-compose services for a single-app project (no workspace config).\n * Starts all services defined in docker-compose.yml.\n */\nexport async function startComposeServices(\n\tcwd: string,\n\tportEnv?: Record<string, string>,\n\tsecretsEnv?: Record<string, string>,\n): Promise<void> {\n\tconst composeFile = join(cwd, 'docker-compose.yml');\n\tif (!existsSync(composeFile)) {\n\t\treturn;\n\t}\n\n\tconst servicesToStart = parseComposeServiceNames(composeFile);\n\tif (servicesToStart.length === 0) {\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Starting services: ${servicesToStart.join(', ')}`);\n\n\ttry {\n\t\texecSync(`docker compose up -d ${servicesToStart.join(' ')}`, {\n\t\t\tcwd,\n\t\t\tstdio: 'inherit',\n\t\t\tenv: buildDockerComposeEnv(secretsEnv, portEnv),\n\t\t});\n\n\t\tlogger.log('✅ Services started');\n\t} catch (error) {\n\t\tlogger.error('❌ Failed to start services:', (error as Error).message);\n\t\tthrow error;\n\t}\n}\n\n/**\n * Start docker-compose services for a workspace.\n * Discovers all services from docker-compose.yml and starts everything\n * except app services (which are managed by turbo).\n * @internal Exported for testing\n */\nexport async function startWorkspaceServices(\n\tworkspace: { root: string; apps: Record<string, unknown> },\n\tportEnv?: Record<string, string>,\n\tsecretsEnv?: Record<string, string>,\n): Promise<void> {\n\tconst composeFile = join(workspace.root, 'docker-compose.yml');\n\tif (!existsSync(composeFile)) {\n\t\treturn;\n\t}\n\n\t// Discover all services from docker-compose.yml\n\tconst allServices = parseComposeServiceNames(composeFile);\n\n\t// Exclude app services (managed by turbo, not docker)\n\tconst appNames = new Set(Object.keys(workspace.apps));\n\tconst servicesToStart = allServices.filter((name) => !appNames.has(name));\n\n\tif (servicesToStart.length === 0) {\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Starting services: ${servicesToStart.join(', ')}`);\n\n\ttry {\n\t\t// Start services with docker-compose, passing secrets so that\n\t\t// POSTGRES_USER, POSTGRES_PASSWORD, etc. are interpolated correctly\n\t\texecSync(`docker compose up -d ${servicesToStart.join(' ')}`, {\n\t\t\tcwd: workspace.root,\n\t\t\tstdio: 'inherit',\n\t\t\tenv: buildDockerComposeEnv(secretsEnv, portEnv),\n\t\t});\n\n\t\tlogger.log('✅ Services started');\n\t} catch (error) {\n\t\tlogger.error('❌ Failed to start services:', (error as Error).message);\n\t\tthrow error;\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Secrets loading\n// ---------------------------------------------------------------------------\n\n/**\n * Load and flatten secrets for an app from encrypted storage.\n * For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.\n * @internal Exported for testing\n */\nexport async function loadSecretsForApp(\n\tsecretsRoot: string,\n\tappName?: string,\n\tstages: string[] = ['dev', 'development'],\n): Promise<Record<string, string>> {\n\tlet secrets: Record<string, string> = {};\n\n\tfor (const stage of stages) {\n\t\tif (secretsExist(stage, secretsRoot)) {\n\t\t\tconst stageSecrets = await readStageSecrets(stage, secretsRoot);\n\t\t\tif (stageSecrets) {\n\t\t\t\tlogger.log(`🔐 Loading secrets from stage: ${stage}`);\n\t\t\t\tsecrets = toEmbeddableSecrets(stageSecrets);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\n\tif (Object.keys(secrets).length === 0) {\n\t\treturn {};\n\t}\n\n\t// Single app mode - no mapping needed\n\tif (!appName) {\n\t\treturn secrets;\n\t}\n\n\t// Workspace app mode - map {APP}_* to generic names\n\tconst prefix = appName.toUpperCase();\n\tconst mapped = { ...secrets };\n\n\t// Map {APP}_DATABASE_URL → DATABASE_URL\n\tconst appDbUrl = secrets[`${prefix}_DATABASE_URL`];\n\tif (appDbUrl) {\n\t\tmapped.DATABASE_URL = appDbUrl;\n\t}\n\n\treturn mapped;\n}\n\n/**\n * Walk up the directory tree to find the root containing .gkm/secrets/.\n * @internal Exported for testing\n */\nexport function findSecretsRoot(startDir: string): string {\n\tlet dir = startDir;\n\twhile (dir !== '/') {\n\t\tif (existsSync(join(dir, '.gkm', 'secrets'))) {\n\t\t\treturn dir;\n\t\t}\n\t\tconst parent = dirname(dir);\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn startDir;\n}\n\n// ---------------------------------------------------------------------------\n// Credentials preload / injection\n// ---------------------------------------------------------------------------\n\n/**\n * Generate the credentials injection code snippet.\n * This is the common logic used by both entry wrapper and exec preload.\n * @internal\n */\nfunction generateCredentialsInjection(secretsJsonPath: string): string {\n\treturn `import { existsSync, readFileSync } from 'node:fs';\n\n// Inject dev secrets via globalThis and process.env\n// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where\n// Object.assign on the Credentials export only mutates one module copy.\nconst secretsPath = '${secretsJsonPath}';\nif (existsSync(secretsPath)) {\n  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));\n  globalThis.__gkm_credentials__ = secrets;\n  Object.assign(process.env, secrets);\n}\n`;\n}\n\n/**\n * Create a preload script that injects secrets into Credentials.\n * Used by `gkm exec` to inject secrets before running any command.\n * @internal Exported for testing\n */\nexport async function createCredentialsPreload(\n\tpreloadPath: string,\n\tsecretsJsonPath: string,\n): Promise<void> {\n\tconst content = `/**\n * Credentials preload generated by 'gkm exec'\n * This file is loaded via NODE_OPTIONS=\"--import <path>\"\n */\n${generateCredentialsInjection(secretsJsonPath)}`;\n\n\tawait writeFile(preloadPath, content);\n}\n\n/**\n * Create a wrapper script that injects secrets before importing the entry file.\n * @internal Exported for testing\n */\nexport async function createEntryWrapper(\n\twrapperPath: string,\n\tentryPath: string,\n\tsecretsJsonPath?: string,\n): Promise<void> {\n\tconst credentialsInjection = secretsJsonPath\n\t\t? `${generateCredentialsInjection(secretsJsonPath)}\n`\n\t\t: '';\n\n\t// Use dynamic import() to ensure secrets are assigned before the entry file loads\n\t// Static imports are hoisted, so Object.assign would run after the entry file is loaded\n\tconst content = `#!/usr/bin/env node\n/**\n * Entry wrapper generated by 'gkm dev --entry'\n */\n${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)\nawait import('${entryPath}');\n`;\n\n\tawait writeFile(wrapperPath, content);\n}\n\n// ---------------------------------------------------------------------------\n// Prepare credentials (shared by dev, exec, test)\n// ---------------------------------------------------------------------------\n\n/**\n * Result of preparing credentials.\n */\nexport interface EntryCredentialsResult {\n\t/** Credentials to inject (secrets + PORT) */\n\tcredentials: Record<string, string>;\n\t/** Resolved port (from --port, workspace config, or default 3000) */\n\tresolvedPort: number;\n\t/** Path where credentials JSON was written */\n\tsecretsJsonPath: string;\n\t/** Resolved app name (if in workspace) */\n\tappName: string | undefined;\n\t/** Secrets root directory */\n\tsecretsRoot: string;\n\t/** Workspace app info (if in a workspace) */\n\tappInfo?: WorkspaceAppInfo;\n}\n\n/**\n * Prepare credentials for dev/exec/test modes.\n * Loads workspace config, secrets, resolves Docker ports, rewrites URLs,\n * injects PORT, dependency URLs, and writes credentials JSON.\n *\n * @param options.resolveDockerPorts - How to resolve Docker ports:\n *   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.\n *   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.\n * @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].\n * @param options.startDocker - Start Docker Compose services after port resolution. Default: false.\n * @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.\n * @internal Exported for testing\n */\nexport async function prepareEntryCredentials(options: {\n\texplicitPort?: number;\n\tcwd?: string;\n\tresolveDockerPorts?: 'full' | 'readonly';\n\t/** Secret stages to try, in order. Default: ['dev', 'development'] */\n\tstages?: string[];\n\t/** Start Docker Compose services after port resolution. Default: false */\n\tstartDocker?: boolean;\n\t/** Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json' */\n\tsecretsFileName?: string;\n}): Promise<EntryCredentialsResult> {\n\tconst cwd = options.cwd ?? process.cwd();\n\tconst portMode = options.resolveDockerPorts ?? 'full';\n\n\t// Try to get workspace app config for port and secrets\n\tlet workspaceAppPort: number | undefined;\n\tlet secretsRoot: string = cwd;\n\tlet appName: string | undefined;\n\tlet appInfo: WorkspaceAppInfo | undefined;\n\n\ttry {\n\t\tappInfo = await loadWorkspaceAppInfo(cwd);\n\t\tworkspaceAppPort = appInfo.app.port;\n\t\tsecretsRoot = appInfo.workspaceRoot;\n\t\tappName = appInfo.appName;\n\t} catch {\n\t\t// Not in a workspace - use defaults (expected for non-gkm apps using gkm exec)\n\t\tsecretsRoot = findSecretsRoot(cwd);\n\t\tappName = getAppNameFromCwd(cwd) ?? undefined;\n\t}\n\n\t// Determine port: explicit --port > workspace config > default 3000\n\tconst resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3000;\n\n\t// Load secrets and inject PORT\n\tconst credentials = await loadSecretsForApp(\n\t\tsecretsRoot,\n\t\tappName,\n\t\toptions.stages,\n\t);\n\n\t// Always inject PORT into credentials so apps can read it\n\tcredentials.PORT = String(resolvedPort);\n\n\t// Resolve Docker ports and rewrite connection URLs\n\tconst composePath = join(secretsRoot, 'docker-compose.yml');\n\tconst mappings = parseComposePortMappings(composePath);\n\tif (mappings.length > 0) {\n\t\tlet resolvedPorts: ResolvedServicePorts;\n\n\t\tif (portMode === 'full') {\n\t\t\t// Full resolution: probe containers, saved state, find available ports\n\t\t\tresolvedPorts = await resolveServicePorts(secretsRoot);\n\t\t} else {\n\t\t\t// Readonly: check running containers and saved state only\n\t\t\tconst savedPorts = await loadPortState(secretsRoot);\n\t\t\tconst ports: PortState = {};\n\n\t\t\tfor (const mapping of mappings) {\n\t\t\t\tconst containerPort = getContainerHostPort(\n\t\t\t\t\tsecretsRoot,\n\t\t\t\t\tmapping.service,\n\t\t\t\t\tmapping.containerPort,\n\t\t\t\t);\n\t\t\t\tif (containerPort !== null) {\n\t\t\t\t\tports[mapping.envVar] = containerPort;\n\t\t\t\t} else {\n\t\t\t\t\tconst saved = savedPorts[mapping.envVar];\n\t\t\t\t\tif (saved !== undefined) {\n\t\t\t\t\t\tports[mapping.envVar] = saved;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tresolvedPorts = { dockerEnv: {}, ports, mappings };\n\t\t}\n\n\t\t// Start Docker services if requested (between port resolution and URL rewriting)\n\t\t// Docker needs raw secrets (POSTGRES_USER, etc.) + resolved port env for compose interpolation\n\t\tif (options.startDocker) {\n\t\t\tif (appInfo) {\n\t\t\t\tawait startWorkspaceServices(\n\t\t\t\t\tappInfo.workspace,\n\t\t\t\t\tresolvedPorts.dockerEnv,\n\t\t\t\t\tcredentials,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tawait startComposeServices(\n\t\t\t\t\tsecretsRoot,\n\t\t\t\t\tresolvedPorts.dockerEnv,\n\t\t\t\t\tcredentials,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(resolvedPorts.ports).length > 0) {\n\t\t\tconst rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);\n\t\t\tObject.assign(credentials, rewritten);\n\t\t\tlogger.log(\n\t\t\t\t`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`,\n\t\t\t);\n\t\t}\n\t}\n\n\t// Inject dependency URLs (works for both frontend and backend apps)\n\tif (appInfo?.appName) {\n\t\tconst depEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);\n\t\tObject.assign(credentials, depEnv);\n\t}\n\n\t// Default event connection strings to pgboss when postgres is available.\n\t// Normally these come from secrets (gkm setup always creates pgboss credentials),\n\t// but this handles old secrets files that predate the pgboss default.\n\tif (\n\t\t!credentials.EVENT_PUBLISHER_CONNECTION_STRING &&\n\t\t!credentials.EVENT_SUBSCRIBER_CONNECTION_STRING &&\n\t\tcredentials.PGBOSS_DB_USER\n\t) {\n\t\tconst pgbossUrl = generatePgBossUrl({\n\t\t\tusername: credentials.PGBOSS_DB_USER,\n\t\t\tpassword: credentials.PGBOSS_DB_PASSWORD ?? '',\n\t\t\thost: credentials.POSTGRES_HOST ?? 'localhost',\n\t\t\tport: Number(credentials.POSTGRES_PORT ?? '5432'),\n\t\t\tdatabase: credentials.POSTGRES_DB ?? 'app',\n\t\t});\n\t\tcredentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;\n\t\tcredentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;\n\t}\n\n\t// Write secrets to temp JSON file (always write since we have PORT)\n\t// Use app-specific filename to avoid race conditions when running multiple apps via turbo\n\tconst secretsDir = join(secretsRoot, '.gkm');\n\tawait mkdir(secretsDir, { recursive: true });\n\tconst secretsFileName =\n\t\toptions.secretsFileName ??\n\t\t(appName ? `dev-secrets-${appName}.json` : 'dev-secrets.json');\n\tconst secretsJsonPath = join(secretsDir, secretsFileName);\n\tawait writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));\n\n\treturn {\n\t\tcredentials,\n\t\tresolvedPort,\n\t\tsecretsJsonPath,\n\t\tappName,\n\t\tsecretsRoot,\n\t\tappInfo,\n\t};\n}\n","import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tresolveServicePorts,\n\tstartWorkspaceServices,\n} from '../credentials/index.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateLocalStackCredentials,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tconst stage = options.stage ?? 'development';\n\n\tlogger.log('\\n🔧 Setting up development environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tif (isMultiApp && workspace.services.db) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Start Docker services with resolved ports\n\tif (!options.skipDocker) {\n\t\tconst composeFile = join(workspace.root, 'docker-compose.yml');\n\t\tif (existsSync(composeFile)) {\n\t\t\tlogger.log('');\n\t\t\tconst resolvedPorts = await resolveServicePorts(workspace.root);\n\t\t\tawait startWorkspaceServices(workspace, resolvedPorts.dockerEnv);\n\t\t} else {\n\t\t\tlogger.log('⚠️  No docker-compose.yml found. Skipping Docker services.');\n\t\t}\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(secrets, workspace);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tconst serviceMap: {\n\t\tkey: keyof typeof workspace.services;\n\t\tname: ComposeServiceName;\n\t}[] = [\n\t\t{ key: 'db', name: 'postgres' },\n\t\t{ key: 'cache', name: 'redis' },\n\t\t{ key: 'storage', name: 'minio' },\n\t\t{ key: 'mail', name: 'mailpit' },\n\t];\n\n\tfor (const { key, name } of serviceMap) {\n\t\tif (workspace.services[key] && !result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile events backend\n\tconst eventsBackend = workspace.services.events;\n\tif (eventsBackend && result.eventsBackend !== eventsBackend) {\n\t\tresult.eventsBackend = eventsBackend;\n\n\t\t// Add localstack credentials if needed\n\t\tif (eventsBackend === 'sns' && !result.services.localstack) {\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: {\n\t\t\t\t\t...result.services,\n\t\t\t\t\tlocalstack: generateLocalStackCredentials(),\n\t\t\t\t},\n\t\t\t};\n\t\t\tlogger.log('   🔄 Adding missing service credentials: localstack');\n\t\t\tchanged = true;\n\t\t}\n\n\t\t// Add rabbitmq credentials if needed (for rabbitmq events)\n\t\tif (eventsBackend === 'rabbitmq' && !result.services.rabbitmq) {\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: {\n\t\t\t\t\t...result.services,\n\t\t\t\t\trabbitmq: generateServiceCredentials('rabbitmq'),\n\t\t\t\t},\n\t\t\t};\n\t\t\tlogger.log('   🔄 Adding missing service credentials: rabbitmq');\n\t\t\tchanged = true;\n\t\t}\n\n\t\t// Regenerate URLs with new events backend\n\t\tresult.urls = generateConnectionUrls(result.services, eventsBackend);\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): StageSecrets {\n\t// Determine services from workspace config\n\tconst serviceNames: ComposeServiceName[] = [];\n\tif (workspace.services.db) serviceNames.push('postgres');\n\tif (workspace.services.cache) serviceNames.push('redis');\n\tif (workspace.services.storage) serviceNames.push('minio');\n\tif (workspace.services.mail) serviceNames.push('mailpit');\n\tif (workspace.services.events === 'sns') serviceNames.push('localstack');\n\tif (workspace.services.events === 'rabbitmq') serviceNames.push('rabbitmq');\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(stage, workspace);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(stage, workspace);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,MAAMA,WAAS;;;;;AAUf,SAAgB,aACfC,WACAC,MAAc,QAAQ,KAAK,EACe;CAC1C,MAAMC,SAAmB,CAAE;CAC3B,MAAMC,UAAoB,CAAE;CAG5B,MAAM,WAAW,YACd,MAAM,QAAQ,UAAU,GACvB,YACA,CAAC,SAAU,IACZ,CAAC,MAAO;AAGX,MAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,UAAU,uBAAQ,KAAK,QAAQ;AACrC,MAAI,wBAAW,QAAQ,EAAE;AACxB,sBAAa;IAAE,MAAM;IAAS,UAAU;IAAM,OAAO;GAAM,EAAC;AAC5D,UAAO,KAAK,QAAQ;EACpB,WAAU,UAEV,SAAQ,KAAK,QAAQ;CAEtB;AAED,QAAO;EAAE;EAAQ;CAAS;AAC1B;;;;;AAUD,eAAsB,gBAAgBC,MAAgC;AACrE,QAAO,IAAI,QAAQ,CAACC,cAAY;EAC/B,MAAM,SAAS,4BAAc;AAE7B,SAAO,KAAK,SAAS,CAACC,QAA+B;AACpD,OAAI,IAAI,SAAS,aAChB,WAAQ,MAAM;OAEd,WAAQ,MAAM;EAEf,EAAC;AAEF,SAAO,KAAK,aAAa,MAAM;AAC9B,UAAO,OAAO;AACd,aAAQ,KAAK;EACb,EAAC;AAEF,SAAO,OAAO,KAAK;CACnB;AACD;;;;;AAMD,eAAsB,kBACrBC,eACA,cAAc,IACI;AAClB,MAAK,IAAI,IAAI,GAAG,IAAI,aAAa,KAAK;EACrC,MAAM,OAAO,gBAAgB;AAC7B,MAAI,MAAM,gBAAgB,KAAK,CAC9B,QAAO;AAER,WAAO,KAAK,WAAW,KAAK,qBAAqB,OAAO,EAAE,KAAK;CAC/D;AAED,OAAM,IAAI,OACR,gDAAgD,YAAY,uBAAuB,cAAc;AAEnG;AA0BD,MAAM,kBAAkB;;;;;;;AAQxB,SAAgB,yBACfC,aACuB;AACvB,MAAK,wBAAW,YAAY,CAC3B,QAAO,CAAE;CAGV,MAAM,UAAU,0BAAa,aAAa,QAAQ;CAClD,MAAM,UAAU,gBAAU,QAAQ;AAIlC,MAAK,SAAS,SACb,QAAO,CAAE;CAGV,MAAMC,UAAgC,CAAE;AAExC,MAAK,MAAM,CAAC,aAAa,cAAc,IAAI,OAAO,QAAQ,QAAQ,SAAS,CAC1E,MAAK,MAAM,eAAe,eAAe,SAAS,CAAE,GAAE;EACrD,MAAM,QAAQ,OAAO,YAAY,CAAC,MAAM,2BAA2B;AACnE,MAAI,QAAQ,MAAM,MAAM,MAAM,MAAM,GACnC,SAAQ,KAAK;GACZ,SAAS;GACT,QAAQ,MAAM;GACd,aAAa,OAAO,MAAM,GAAG;GAC7B,eAAe,OAAO,MAAM,GAAG;EAC/B,EAAC;CAEH;AAGF,QAAO;AACP;;;;;AAMD,eAAsB,cAAcC,eAA2C;AAC9E,KAAI;EACH,MAAM,MAAM,MAAM,+BAAS,oBAAK,eAAe,gBAAgB,EAAE,QAAQ;AACzE,SAAO,KAAK,MAAM,IAAI;CACtB,QAAO;AACP,SAAO,CAAE;CACT;AACD;;;;;AAMD,eAAsB,cACrBA,eACAC,OACgB;CAChB,MAAM,MAAM,oBAAK,eAAe,OAAO;AACvC,OAAM,4BAAM,KAAK,EAAE,WAAW,KAAM,EAAC;AACrC,OAAM,gCACL,oBAAK,eAAe,gBAAgB,GACnC,EAAE,KAAK,UAAU,OAAO,MAAM,EAAE,CAAC,IAClC;AACD;;;;;;AAOD,SAAgB,qBACfD,eACAE,SACAC,eACgB;AAChB,KAAI;EACH,MAAM,SAAS,kCAAU,sBAAsB,QAAQ,GAAG,cAAc,GAAG;GAC1E,KAAK;GACL,OAAO;EACP,EAAC,CACA,UAAU,CACV,MAAM;EACR,MAAM,QAAQ,OAAO,MAAM,UAAU;AACrC,SAAO,QAAQ,OAAO,MAAM,GAAG,GAAG;CAClC,QAAO;AACP,SAAO;CACP;AACD;;;;;;;AAQD,eAAsB,oBACrBH,eACgC;CAChC,MAAM,cAAc,oBAAK,eAAe,qBAAqB;CAC7D,MAAM,WAAW,yBAAyB,YAAY;AAEtD,KAAI,SAAS,WAAW,EACvB,QAAO;EAAE,WAAW,CAAE;EAAE,OAAO,CAAE;EAAE,UAAU,CAAE;CAAE;CAGlD,MAAM,aAAa,MAAM,cAAc,cAAc;CACrD,MAAMI,YAAoC,CAAE;CAC5C,MAAMH,QAAmB,CAAE;CAE3B,MAAM,gCAAgB,IAAI;AAE1B,UAAO,IAAI,kCAAkC;AAE7C,MAAK,MAAM,WAAW,UAAU;EAE/B,MAAM,gBAAgB,qBACrB,eACA,QAAQ,SACR,QAAQ,cACR;AACD,MAAI,kBAAkB,MAAM;AAC3B,SAAM,QAAQ,UAAU;AACxB,aAAU,QAAQ,UAAU,OAAO,cAAc;AACjD,iBAAc,IAAI,cAAc;AAChC,YAAO,KACL,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,cAAc,uCAAuC,cAAc,EACvG;AACD;EACA;EAGD,MAAM,YAAY,WAAW,QAAQ;AACrC,MACC,cACC,cAAc,IAAI,UAAU,IAC5B,MAAM,gBAAgB,UAAU,EAChC;AACD,SAAM,QAAQ,UAAU;AACxB,aAAU,QAAQ,UAAU,OAAO,UAAU;AAC7C,iBAAc,IAAI,UAAU;AAC5B,YAAO,KACL,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,cAAc,qBAAqB,UAAU,EACjF;AACD;EACA;EAGD,IAAI,eAAe,MAAM,kBAAkB,QAAQ,YAAY;AAC/D,SAAO,cAAc,IAAI,aAAa,CACrC,gBAAe,MAAM,kBAAkB,eAAe,EAAE;AAEzD,QAAM,QAAQ,UAAU;AACxB,YAAU,QAAQ,UAAU,OAAO,aAAa;AAChD,gBAAc,IAAI,aAAa;AAE/B,MAAI,iBAAiB,QAAQ,YAC5B,UAAO,KACL,OAAO,QAAQ,QAAQ,GAAG,QAAQ,cAAc,SAAS,QAAQ,YAAY,wBAAwB,aAAa,EACnH;MAED,UAAO,KACL,OAAO,QAAQ,QAAQ,GAAG,QAAQ,cAAc,uBAAuB,aAAa,EACrF;CAEF;AAED,OAAM,cAAc,eAAe,MAAM;AAEzC,QAAO;EAAE;EAAW;EAAO;CAAU;AACrC;;;;;;AAWD,SAAgB,iBACfI,KACAC,SACAC,SACS;AACT,KAAI,YAAY,QAAS,QAAO;CAEhC,IAAI,SAAS,IAAI,QAChB,IAAI,QAAQ,GAAG,QAAQ,cAAc,OACpC,GAAG,QAAQ,EACZ;AAED,UAAS,OAAO,QACf,IAAI,QAAQ,KAAK,QAAQ,gBAAgB,QACxC,KAAK,QAAQ,EACd;AACD,QAAO;AACP;;;;;;;AAQD,SAAgB,qBACfC,SACAC,eACyB;CACzB,MAAM,EAAE,OAAO,UAAU,GAAG;CAC5B,MAAM,SAAS,EAAE,GAAG,QAAS;CAG7B,MAAMC,mBAAoE,CAAE;CAE5E,MAAM,+BAAe,IAAI;AACzB,MAAK,MAAM,WAAW,UAAU;AAC/B,eAAa,IAAI,QAAQ,QAAQ;EACjC,MAAM,WAAW,MAAM,QAAQ;AAC/B,MAAI,oBACH,kBAAiB,KAAK;GACrB,aAAa,QAAQ;GACrB,cAAc;EACd,EAAC;CAEH;AAGD,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;AAClD,OAAK,IAAI,SAAS,QAAQ,CAAE;AAC5B,MAAI,aAAa,IAAI,MAAM,CAC1B,QAAO,OAAO;CAEf;AAGD,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;AAClD,OAAK,IAAI,SAAS,QAAQ,CAAE;AAC5B,OAAK,MAAM,EAAE,aAAa,cAAc,IAAI,iBAC3C,KAAI,UAAU,OAAO,YAAY,CAChC,QAAO,OAAO,OAAO,aAAa;CAGpC;AAGD,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;AAClD,OACE,IAAI,SAAS,OAAO,KACpB,IAAI,SAAS,YAAY,KACzB,IAAI,SAAS,qBAAqB,IACnC,QAAQ,eAER;EAED,IAAI,YAAY;AAChB,OAAK,MAAM,QAAQ,aAClB,aAAY,UAAU,QACrB,IAAI,QAAQ,GAAG,KAAK,IAAI,MACxB,cACA;AAEF,OAAK,MAAM,EAAE,aAAa,cAAc,IAAI,iBAC3C,aAAY,iBAAiB,WAAW,aAAa,aAAa;AAEnE,SAAO,OAAO;CACd;AAED,QAAO;AACP;;;;;;;AAYD,SAAgB,sBACfC,YACAC,SACqC;AACrC,QAAO;EAAE,GAAG,QAAQ;EAAK,GAAG;EAAY,GAAG;CAAS;AACpD;;;;;AAMD,SAAgB,yBAAyBd,aAA+B;AACvE,MAAK,wBAAW,YAAY,CAC3B,QAAO,CAAE;CAGV,MAAM,UAAU,0BAAa,aAAa,QAAQ;CAClD,MAAM,UAAU,gBAAU,QAAQ;AAIlC,QAAO,OAAO,KAAK,SAAS,YAAY,CAAE,EAAC;AAC3C;;;;;AAMD,eAAsB,qBACrBP,KACAqB,SACAD,YACgB;CAChB,MAAM,cAAc,oBAAK,KAAK,qBAAqB;AACnD,MAAK,wBAAW,YAAY,CAC3B;CAGD,MAAM,kBAAkB,yBAAyB,YAAY;AAC7D,KAAI,gBAAgB,WAAW,EAC9B;AAGD,UAAO,KAAK,wBAAwB,gBAAgB,KAAK,KAAK,CAAC,EAAE;AAEjE,KAAI;AACH,oCAAU,uBAAuB,gBAAgB,KAAK,IAAI,CAAC,GAAG;GAC7D;GACA,OAAO;GACP,KAAK,sBAAsB,YAAY,QAAQ;EAC/C,EAAC;AAEF,WAAO,IAAI,qBAAqB;CAChC,SAAQ,OAAO;AACf,WAAO,MAAM,+BAAgC,MAAgB,QAAQ;AACrE,QAAM;CACN;AACD;;;;;;;AAQD,eAAsB,uBACrBE,WACAD,SACAD,YACgB;CAChB,MAAM,cAAc,oBAAK,UAAU,MAAM,qBAAqB;AAC9D,MAAK,wBAAW,YAAY,CAC3B;CAID,MAAM,cAAc,yBAAyB,YAAY;CAGzD,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,UAAU,KAAK;CACpD,MAAM,kBAAkB,YAAY,OAAO,CAAC,UAAU,SAAS,IAAI,KAAK,CAAC;AAEzE,KAAI,gBAAgB,WAAW,EAC9B;AAGD,UAAO,KAAK,wBAAwB,gBAAgB,KAAK,KAAK,CAAC,EAAE;AAEjE,KAAI;AAGH,oCAAU,uBAAuB,gBAAgB,KAAK,IAAI,CAAC,GAAG;GAC7D,KAAK,UAAU;GACf,OAAO;GACP,KAAK,sBAAsB,YAAY,QAAQ;EAC/C,EAAC;AAEF,WAAO,IAAI,qBAAqB;CAChC,SAAQ,OAAO;AACf,WAAO,MAAM,+BAAgC,MAAgB,QAAQ;AACrE,QAAM;CACN;AACD;;;;;;AAWD,eAAsB,kBACrBG,aACAC,SACAC,SAAmB,CAAC,OAAO,aAAc,GACP;CAClC,IAAIR,UAAkC,CAAE;AAExC,MAAK,MAAM,SAAS,OACnB,KAAI,6BAAa,OAAO,YAAY,EAAE;EACrC,MAAM,eAAe,MAAM,iCAAiB,OAAO,YAAY;AAC/D,MAAI,cAAc;AACjB,YAAO,KAAK,iCAAiC,MAAM,EAAE;AACrD,aAAU,oCAAoB,aAAa;AAC3C;EACA;CACD;AAGF,KAAI,OAAO,KAAK,QAAQ,CAAC,WAAW,EACnC,QAAO,CAAE;AAIV,MAAK,QACJ,QAAO;CAIR,MAAM,SAAS,QAAQ,aAAa;CACpC,MAAM,SAAS,EAAE,GAAG,QAAS;CAG7B,MAAM,WAAW,SAAS,EAAE,OAAO;AACnC,KAAI,SACH,QAAO,eAAe;AAGvB,QAAO;AACP;;;;;AAMD,SAAgB,gBAAgBS,UAA0B;CACzD,IAAI,MAAM;AACV,QAAO,QAAQ,KAAK;AACnB,MAAI,wBAAW,oBAAK,KAAK,QAAQ,UAAU,CAAC,CAC3C,QAAO;EAER,MAAM,SAAS,uBAAQ,IAAI;AAC3B,MAAI,WAAW,IAAK;AACpB,QAAM;CACN;AACD,QAAO;AACP;;;;;;AAWD,SAAS,6BAA6BC,iBAAiC;AACtE,SAAQ;;;;;uBAKc,gBAAgB;;;;;;;AAOtC;;;;;;AAOD,eAAsB,yBACrBC,aACAD,iBACgB;CAChB,MAAM,WAAW;;;;EAIhB,6BAA6B,gBAAgB,CAAC;AAE/C,OAAM,gCAAU,aAAa,QAAQ;AACrC;;;;;AAMD,eAAsB,mBACrBE,aACAC,WACAC,iBACgB;CAChB,MAAM,uBAAuB,mBACzB,EAAE,6BAA6B,gBAAgB,CAAC;IAEjD;CAIH,MAAM,WAAW;;;;EAIhB,qBAAqB;gBACP,UAAU;;AAGzB,OAAM,gCAAU,aAAa,QAAQ;AACrC;;;;;;;;;;;;;;AAqCD,eAAsB,wBAAwBC,SAUV;CACnC,MAAM,MAAM,QAAQ,OAAO,QAAQ,KAAK;CACxC,MAAM,WAAW,QAAQ,sBAAsB;CAG/C,IAAIC;CACJ,IAAIV,cAAsB;CAC1B,IAAIW;CACJ,IAAIC;AAEJ,KAAI;AACH,YAAU,MAAM,oCAAqB,IAAI;AACzC,qBAAmB,QAAQ,IAAI;AAC/B,gBAAc,QAAQ;AACtB,YAAU,QAAQ;CAClB,QAAO;AAEP,gBAAc,gBAAgB,IAAI;AAClC,YAAU,iCAAkB,IAAI;CAChC;CAGD,MAAM,eAAe,QAAQ,gBAAgB,oBAAoB;CAGjE,MAAM,cAAc,MAAM,kBACzB,aACA,SACA,QAAQ,OACR;AAGD,aAAY,OAAO,OAAO,aAAa;CAGvC,MAAM,cAAc,oBAAK,aAAa,qBAAqB;CAC3D,MAAM,WAAW,yBAAyB,YAAY;AACtD,KAAI,SAAS,SAAS,GAAG;EACxB,IAAIjB;AAEJ,MAAI,aAAa,OAEhB,iBAAgB,MAAM,oBAAoB,YAAY;OAChD;GAEN,MAAM,aAAa,MAAM,cAAc,YAAY;GACnD,MAAMR,QAAmB,CAAE;AAE3B,QAAK,MAAM,WAAW,UAAU;IAC/B,MAAM,gBAAgB,qBACrB,aACA,QAAQ,SACR,QAAQ,cACR;AACD,QAAI,kBAAkB,KACrB,OAAM,QAAQ,UAAU;SAClB;KACN,MAAM,QAAQ,WAAW,QAAQ;AACjC,SAAI,iBACH,OAAM,QAAQ,UAAU;IAEzB;GACD;AAED,mBAAgB;IAAE,WAAW,CAAE;IAAE;IAAO;GAAU;EAClD;AAID,MAAI,QAAQ,YACX,KAAI,QACH,OAAM,uBACL,QAAQ,WACR,cAAc,WACd,YACA;MAED,OAAM,qBACL,aACA,cAAc,WACd,YACA;AAIH,MAAI,OAAO,KAAK,cAAc,MAAM,CAAC,SAAS,GAAG;GAChD,MAAM,YAAY,qBAAqB,aAAa,cAAc;AAClE,UAAO,OAAO,aAAa,UAAU;AACrC,YAAO,KACL,aAAa,OAAO,KAAK,cAAc,MAAM,CAAC,OAAO,kBACtD;EACD;CACD;AAGD,KAAI,SAAS,SAAS;EACrB,MAAM,SAAS,uCAAqB,QAAQ,WAAW,QAAQ,QAAQ;AACvE,SAAO,OAAO,aAAa,OAAO;CAClC;AAKD,MACE,YAAY,sCACZ,YAAY,sCACb,YAAY,gBACX;EACD,MAAM,YAAY,4CAAkB;GACnC,UAAU,YAAY;GACtB,UAAU,YAAY,sBAAsB;GAC5C,MAAM,YAAY,iBAAiB;GACnC,MAAM,OAAO,YAAY,iBAAiB,OAAO;GACjD,UAAU,YAAY,eAAe;EACrC,EAAC;AACF,cAAY,oCAAoC;AAChD,cAAY,qCAAqC;CACjD;CAID,MAAM,aAAa,oBAAK,aAAa,OAAO;AAC5C,OAAM,4BAAM,YAAY,EAAE,WAAW,KAAM,EAAC;CAC5C,MAAM,kBACL,QAAQ,oBACP,WAAW,cAAc,QAAQ,SAAS;CAC5C,MAAM,kBAAkB,oBAAK,YAAY,gBAAgB;AACzD,OAAM,gCAAU,iBAAiB,KAAK,UAAU,aAAa,MAAM,EAAE,CAAC;AAEtE,QAAO;EACN;EACA;EACA;EACA;EACA;EACA;CACA;AACD;;;;AC7yBD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAa0B,UAAwB,CAAE,GAAiB;CAC7E,MAAM,QAAQ,QAAQ,SAAS;AAE/B,QAAO,IAAI,+CAA+C;CAG1D,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,oCAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;AAGD,KAAI,cAAc,UAAU,SAAS,IAAI;AACxC,QAAM,oDAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;EACxB,MAAM,cAAc,oBAAK,UAAU,MAAM,qBAAqB;AAC9D,MAAI,wBAAW,YAAY,EAAE;AAC5B,UAAO,IAAI,GAAG;GACd,MAAM,gBAAgB,MAAM,oBAAoB,UAAU,KAAK;AAC/D,SAAM,uBAAuB,WAAW,cAAc,UAAU;EAChE,MACA,QAAO,IAAI,6DAA6D;CAEzE;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;;AAUD,eAAe,eACdC,OACAC,WACAH,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,6BAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iCAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAAiB,SAAS,UAAU;AACvD,OAAI,WACH,OAAM,kCAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,6BAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,yBAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kCAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;AAQD,SAAgB,iBACfI,SACAD,WACsB;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;CAG3B,MAAME,aAGA;EACL;GAAE,KAAK;GAAM,MAAM;EAAY;EAC/B;GAAE,KAAK;GAAS,MAAM;EAAS;EAC/B;GAAE,KAAK;GAAW,MAAM;EAAS;EACjC;GAAE,KAAK;GAAQ,MAAM;EAAW;CAChC;AAED,MAAK,MAAM,EAAE,KAAK,MAAM,IAAI,WAC3B,KAAI,UAAU,SAAS,SAAS,OAAO,SAAS,OAAO;EACtD,MAAM,QAAQ,qDAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,iDACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,kDAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,iDAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,gBAAgB,UAAU,SAAS;AACzC,KAAI,iBAAiB,OAAO,kBAAkB,eAAe;AAC5D,SAAO,gBAAgB;AAGvB,MAAI,kBAAkB,UAAU,OAAO,SAAS,YAAY;AAC3D,YAAS;IACR,GAAG;IACH,UAAU;KACT,GAAG,OAAO;KACV,YAAY,yDAA+B;IAC3C;GACD;AACD,UAAO,IAAI,uDAAuD;AAClE,aAAU;EACV;AAGD,MAAI,kBAAkB,eAAe,OAAO,SAAS,UAAU;AAC9D,YAAS;IACR,GAAG;IACH,UAAU;KACT,GAAG,OAAO;KACV,UAAU,qDAA2B,WAAW;IAChD;GACD;AACD,UAAO,IAAI,qDAAqD;AAChE,aAAU;EACV;AAGD,SAAO,OAAO,iDAAuB,OAAO,UAAU,cAAc;AACpE,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,yDAA+B,UAAU;EAC1D,MAAMC,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAC,WACe;CAEf,MAAMI,eAAqC,CAAE;AAC7C,KAAI,UAAU,SAAS,GAAI,cAAa,KAAK,WAAW;AACxD,KAAI,UAAU,SAAS,MAAO,cAAa,KAAK,QAAQ;AACxD,KAAI,UAAU,SAAS,QAAS,cAAa,KAAK,QAAQ;AAC1D,KAAI,UAAU,SAAS,KAAM,cAAa,KAAK,UAAU;AACzD,KAAI,UAAU,SAAS,WAAW,MAAO,cAAa,KAAK,aAAa;AACxE,KAAI,UAAU,SAAS,WAAW,WAAY,cAAa,KAAK,WAAW;CAG3E,MAAM,UAAU,6CAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,yDAA+B,UAAU;KAE1D,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBL,OACAM,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,mCAAoB,IAAI;AAEpD,KAAI,6BAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BAA4B,OAAO,UAAU;AAC7D,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdN,OACAC,WACAH,SACC;CACD,MAAM,UAAU,4BAA4B,OAAO,UAAU;AAG7D,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,6BAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,qBAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,yBAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaG,WAAgCD,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}

package/dist/sync-BLA94rgC.cjs

@@ -1,4 +0,0 @@
-const require_sync = require('./sync-o_CtEbvR.cjs');
-
-exports.pullSecrets = require_sync.pullSecrets;
-exports.pushSecrets = require_sync.pushSecrets;

package/dist/types-B3GQUg3k.d.mts

@@ -1,280 +0,0 @@
-//#region src/types.d.ts
-
-interface PartitionedRoutes {
-  paths: string | string[];
-  partition: (filepath: string) => string;
-}
-type Routes = string | string[] | PartitionedRoutes;
-interface ProviderConfig {
-  enabled?: boolean;
-  outputDir?: string;
-}
-interface AWSApiGatewayConfig extends ProviderConfig {}
-interface AWSLambdaConfig extends ProviderConfig {}
-interface ProductionConfig {
-  /** Enable production mode (default: false) */
-  enabled?: boolean;
-  /** Bundle server into single file (default: true) */
-  bundle?: boolean;
-  /** Minify bundled output (default: true) */
-  minify?: boolean;
-  /** Health check endpoint path (default: '/health') */
-  healthCheck?: string;
-  /** Enable graceful shutdown handling (default: true) */
-  gracefulShutdown?: boolean;
-  /** Packages to exclude from bundling (default: []) */
-  external?: string[];
-  /** Include subscribers in production build (default: 'exclude' for serverless) */
-  subscribers?: 'include' | 'exclude';
-  /** Include OpenAPI spec in production (default: false) */
-  openapi?: boolean;
-  /**
-   * Enable build-time optimized handler generation (default: true)
-   * Generates specialized handlers based on endpoint tier:
-   * - minimal: Near-raw-Hono performance for simple endpoints
-   * - standard: Optimized handlers for auth/services
-   * - full: Uses HonoEndpoint.addRoutes for complex endpoints
-   */
-  optimizedHandlers?: boolean;
-}
-/** Service-specific configuration for docker-compose */
-interface ServiceConfig {
-  /**
-   * Full Docker image reference (e.g., 'postgis/postgis:16-3.4-alpine').
-   * When specified, overrides the default image entirely.
-   */
-  image?: string;
-  /**
-   * Docker image version/tag (e.g., '15-alpine' for postgres).
-   * Only used when `image` is not specified.
-   */
-  version?: string;
-}
-/**
- * Supported event backend types.
- *
- * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.
- * - `sns`: Adds LocalStack container with SNS+SQS services.
- * - `rabbitmq`: Adds RabbitMQ container.
- *
- * All backends generate EVENT_PUBLISHER_CONNECTION_STRING and EVENT_SUBSCRIBER_CONNECTION_STRING.
- */
-type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';
-/** Supported docker-compose service names */
-type ComposeServiceName = 'postgres' | 'redis' | 'rabbitmq' | 'minio' | 'mailpit' | 'localstack';
-/** Services configuration - can be boolean (use defaults) or object with version */
-type ComposeServicesConfig = { [K in ComposeServiceName]?: boolean | ServiceConfig };
-interface DockerConfig {
-  /** Container registry URL (e.g., 'ghcr.io/myorg') */
-  registry?: string;
-  /** Docker image name (default: derived from package.json name) */
-  imageName?: string;
-  /** Base Docker image (default: 'node:22-alpine') */
-  baseImage?: string;
-  /** Container port (default: 3000) */
-  port?: number;
-  /** docker-compose services to include */
-  compose?: {
-    /**
-     * Services to include in docker-compose.
-     * Can be an object with service configs or an array of service names (legacy).
-     *
-     * @example Object format (recommended)
-     * services: {
-     *   postgres: { version: '15-alpine' },
-     *   redis: true,  // use default version
-     * }
-     *
-     * @example Array format (legacy, uses default versions)
-     * services: ['postgres', 'redis']
-     */
-    services?: ComposeServicesConfig | ComposeServiceName[];
-  };
-}
-interface ServerConfig extends ProviderConfig {
-  enableOpenApi?: boolean;
-  port?: number;
-  /** Production build configuration */
-  production?: ProductionConfig;
-}
-type Runtime = 'node' | 'bun';
-interface TelescopeConfig {
-  /** Enable/disable telescope (default: true in development) */
-  enabled?: boolean;
-  /** Port for telescope to use (defaults to server port) */
-  port?: number;
-  /** Path prefix for telescope UI (default: /__telescope) */
-  path?: string;
-  /** Ignore patterns for telescope (e.g., ['/health', '/metrics']) */
-  ignore?: string[];
-  /** Record request/response bodies (default: true) */
-  recordBody?: boolean;
-  /** Maximum entries to keep in memory (default: 1000) */
-  maxEntries?: number;
-  /** Enable WebSocket for real-time updates (default: true, requires @hono/node-ws for Node.js) */
-  websocket?: boolean;
-}
-interface StudioConfig {
-  /** Enable/disable studio (default: true in development) */
-  enabled?: boolean;
-  /** Path prefix for studio UI (default: /__studio) */
-  path?: string;
-  /** Schema to introspect (default: 'public') */
-  schema?: string;
-}
-interface OpenApiConfig {
-  /** Enable OpenAPI generation (default: true) */
-  enabled?: boolean;
-  /** API title */
-  title?: string;
-  /** API version */
-  version?: string;
-  /** API description */
-  description?: string;
-}
-interface HooksConfig {
-  /**
-   * Path to a module exporting server lifecycle hooks.
-   * The module should export `beforeSetup` and/or `afterSetup` functions.
-   *
-   * @example
-   * ```typescript
-   * // src/config/hooks.ts
-   * import type { Hono } from 'hono';
-   * import type { Logger } from '@geekmidas/logger';
-   * import type { EnvironmentParser } from '@geekmidas/envkit';
-   *
-   * // Called BEFORE gkm endpoints are registered
-   * export function beforeSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {
-   *   app.use('*', cors());
-   *   app.get('/custom/health', (c) => c.json({ status: 'ok' }));
-   * }
-   *
-   * // Called AFTER gkm endpoints are registered
-   * export function afterSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {
-   *   app.notFound((c) => c.json({ error: 'Not found' }, 404));
-   *   app.onError((err, c) => c.json({ error: err.message }, 500));
-   * }
-   * ```
-   */
-  server?: string;
-}
-/** Dokploy deployment configuration */
-interface DokployProviderConfig {
-  /** Dokploy API endpoint (e.g., 'https://dokploy.example.com') */
-  endpoint: string;
-  /** Project ID in Dokploy */
-  projectId: string;
-  /** Application ID in Dokploy */
-  applicationId: string;
-  /** Container registry (overrides docker.registry if set) */
-  registry?: string;
-  /** Registry ID in Dokploy (recommended for private registries) */
-  registryId?: string;
-}
-interface ProvidersConfig {
-  aws?: {
-    apiGateway?: {
-      v1?: boolean | AWSApiGatewayConfig;
-      v2?: boolean | AWSApiGatewayConfig;
-    };
-    lambda?: {
-      functions?: boolean | AWSLambdaConfig;
-      crons?: boolean | AWSLambdaConfig;
-    };
-  };
-  server?: boolean | ServerConfig;
-  /** Dokploy deployment configuration */
-  dokploy?: boolean | DokployProviderConfig;
-}
-interface GkmConfig {
-  routes: Routes;
-  functions?: Routes;
-  crons?: Routes;
-  subscribers?: Routes;
-  queues?: Routes;
-  topics?: Routes;
-  envParser: string;
-  logger: string;
-  providers?: ProvidersConfig;
-  /**
-   * Server lifecycle hooks for customizing the Hono app.
-   * Allows adding custom routes, middleware, error handlers, etc.
-   *
-   * @example
-   * hooks: {
-   *   server: './src/config/hooks'
-   * }
-   */
-  hooks?: HooksConfig;
-  /**
-   * Telescope configuration for debugging/monitoring.
-   * Can be:
-   * - A string path to a module that exports a Telescope instance (recommended)
-   * - A boolean to enable/disable with defaults
-   * - A TelescopeConfig object for inline configuration
-   */
-  telescope?: string | boolean | TelescopeConfig;
-  /**
-   * Studio configuration for database browsing.
-   * Can be:
-   * - A string path to a module that exports a Studio instance (recommended)
-   * - A boolean to enable/disable with defaults
-   * - A StudioConfig object for inline configuration
-   *
-   * Requires a database connection configured via services.
-   */
-  studio?: string | boolean | StudioConfig;
-  /**
-   * OpenAPI generation configuration.
-   * Can be:
-   * - A boolean to enable/disable with defaults (output: ./src/api/openapi.ts)
-   * - An OpenApiConfig object for customization
-   *
-   * When enabled, OpenAPI spec is generated on startup and regenerated on route changes.
-   *
-   * @example
-   * openapi: true
-   *
-   * @example
-   * openapi: {
-   *   output: './src/api/openapi.ts',
-   *   title: 'My API',
-   *   version: '1.0.0',
-   * }
-   */
-  openapi?: boolean | OpenApiConfig;
-  /** Runtime to use for dev server (default: 'node') */
-  runtime?: Runtime;
-  /**
-   * Environment file(s) to load for development.
-   * Can be:
-   * - A string path to a single env file (e.g., '.env.local')
-   * - An array of paths to load in order (later files override earlier)
-   * - Defaults to '.env' if not specified
-   *
-   * @example
-   * env: '.env.local'
-   *
-   * @example
-   * env: ['.env', '.env.local']
-   */
-  env?: string | string[];
-  /**
-   * Docker deployment configuration.
-   * Used by `gkm docker` and `gkm prepack` commands.
-   *
-   * @example
-   * docker: {
-   *   registry: 'ghcr.io/myorg',
-   *   imageName: 'my-api',
-   *   compose: {
-   *     services: ['postgres', 'redis']
-   *   }
-   * }
-   */
-  docker?: DockerConfig;
-}
-//#endregion
-export { EventsBackend, GkmConfig, HooksConfig, OpenApiConfig, ProvidersConfig, Routes, Runtime, StudioConfig, TelescopeConfig };
-//# sourceMappingURL=types-B3GQUg3k.d.mts.map

package/dist/types-B3GQUg3k.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types-B3GQUg3k.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;AAYY,UALK,iBAAA,CAKwB;EAaxB,KAAA,EAAA,MAAA,GAAA,MAAc,EAAA;EAKd,SAAA,EAAA,CAAA,QAAA,EAAoB,MAAA,EAAA,GAAQ,MAAA;AAI7C;AAIiB,KA1BL,MAAA,GA0BK,MAAgB,GAAA,MAAA,EAAA,GA1BQ,iBA0BR;AAkDrB,UA/DK,cAAA,CA+DQ;EAGb,OAAA,CAAA,EAAA,OAAA;EASA,SAAA,CAAA,EAAA,MAAA;;AACL,UAvEU,mBAAA,SAA4B,cAuEtC,CAAA;AAA6C,UAnEnC,eAAA,SAAwB,cAmEW,CAAA,CAGpD;AAA6B,UAlEZ,gBAAA,CAkEY;EAAA;EAwBK,OAAG,CAAA,EAAA,OAAA;EAAkB;EAItC,MAAA,CAAA,EAAA,OAAa;EAAA;EAAA,MAIhB,CAAA,EAAA,OAAA;EAAgB;EAJsB,WAAA,CAAA,EAAA,MAAA;EAOxC;EAEK,gBAAA,CAAA,EAAe,OAAA;EAiBf;EASA,QAAA,CAAA,EAAA,MAAa,EAAA;EAWb;EA6BA,WAAA,CAAA,EAAA,SAAA,GAAqB,SAAA;EAarB;EAAe,OAAA,CAAA,EAAA,OAAA;EAAA;;;;;;AAaU;EAGzB,iBAAS,CAAA,EAAA,OAAA;;;AAEb,UA5KI,aAAA,CA4KJ;EAAM;;;;EAIH,KAGH,CAAA,EAAA,MAAA;EAAe;;;;EA+CM,OAEvB,CAAA,EAAA,MAAA;;AA4BW;;;;;;;;;KA1OV,aAAA;;KAGA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;UAGtB,YAAA;;;;;;;;;;;;;;;;;;;;;;;;eAwBJ,wBAAwB;;;UAIpB,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;UACR;cACI;UACJ;gBACM;WACL;WACA;;;cAGG;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD"}