@geekmidas/cli 9.0.2 → 10.0.0-alpha.1

package/dist/setup-WZ-xqAQO.cjs

@@ -1,849 +0,0 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const require_workspace = require('./workspace-CQTT7HJQ.cjs');
-const require_config = require('./config-DujV8DbR.cjs');
-const require_fullstack_secrets = require('./fullstack-secrets-BYzi6Hwl.cjs');
-const require_storage = require('./storage-B1wvztiJ.cjs');
-const require_sync = require('./sync-o_CtEbvR.cjs');
-const node_fs = require_chunk.__toESM(require("node:fs"));
-const node_path = require_chunk.__toESM(require("node:path"));
-const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
-const node_child_process = require_chunk.__toESM(require("node:child_process"));
-const node_net = require_chunk.__toESM(require("node:net"));
-const dotenv = require_chunk.__toESM(require("dotenv"));
-const yaml = require_chunk.__toESM(require("yaml"));
-const prompts = require_chunk.__toESM(require("prompts"));
-
-//#region src/credentials/index.ts
-const logger$1 = console;
-/**
-* Load environment files
-* @internal Exported for testing
-*/
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = (0, node_path.resolve)(cwd, envFile);
-		if ((0, node_fs.existsSync)(envPath)) {
-			(0, dotenv.config)({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
-}
-/**
-* Check if a port is available
-* @internal Exported for testing
-*/
-async function isPortAvailable(port) {
-	return new Promise((resolve$1) => {
-		const server = (0, node_net.createServer)();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$1(false);
-			else resolve$1(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve$1(true);
-		});
-		server.listen(port);
-	});
-}
-/**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
-*/
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
-	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
-}
-const PORT_STATE_PATH = ".gkm/ports.json";
-/**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
-*/
-function parseComposePortMappings(composePath) {
-	if (!(0, node_fs.existsSync)(composePath)) return [];
-	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
-	const compose = (0, yaml.parse)(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
-}
-/**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function loadPortState(workspaceRoot) {
-	try {
-		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-/**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function savePortState(workspaceRoot, ports) {
-	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
-/**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
-*/
-function getContainerHostPort(workspaceRoot, service, containerPort) {
-	try {
-		const result = (0, node_child_process.execSync)(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim();
-		const match = result.match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function resolveServicePorts(workspaceRoot) {
-	const composePath = (0, node_path.join)(workspaceRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger$1.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger$1.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger$1.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger$1.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger$1.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
-	}
-	await savePortState(workspaceRoot, ports);
-	return {
-		dockerEnv,
-		ports,
-		mappings
-	};
-}
-/**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
-*/
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
-}
-/**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
-*/
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
-	}
-	return result;
-}
-/**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
-*/
-function buildDockerComposeEnv(secretsEnv, portEnv) {
-	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
-	};
-}
-/**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
-*/
-function parseComposeServiceNames(composePath) {
-	if (!(0, node_fs.existsSync)(composePath)) return [];
-	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
-	const compose = (0, yaml.parse)(content);
-	return Object.keys(compose?.services ?? {});
-}
-/**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
-*/
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = (0, node_path.join)(cwd, "docker-compose.yml");
-	if (!(0, node_fs.existsSync)(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger$1.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger$1.log("✅ Services started");
-	} catch (error) {
-		logger$1.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
-*/
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
-	if (!(0, node_fs.existsSync)(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name) => !appNames.has(name));
-	if (servicesToStart.length === 0) return;
-	logger$1.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger$1.log("✅ Services started");
-	} catch (error) {
-		logger$1.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
-*/
-async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
-	let secrets = {};
-	for (const stage of stages) if (require_storage.secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await require_storage.readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = require_storage.toEmbeddableSecrets(stageSecrets);
-			break;
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
-}
-/**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
-*/
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if ((0, node_fs.existsSync)((0, node_path.join)(dir, ".gkm", "secrets"))) return dir;
-		const parent = (0, node_path.dirname)(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
-/**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
-*/
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
-}
-`;
-}
-/**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
-*/
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await (0, node_fs_promises.writeFile)(preloadPath, content);
-}
-/**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
-*/
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : "";
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await (0, node_fs_promises.writeFile)(wrapperPath, content);
-}
-/**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
-*
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
-*/
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	try {
-		appInfo = await require_config.loadWorkspaceAppInfo(cwd);
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		secretsRoot = findSecretsRoot(cwd);
-		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
-	credentials.PORT = String(resolvedPort);
-	const composePath = (0, node_path.join)(secretsRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
-	if (mappings.length > 0) {
-		let resolvedPorts;
-		if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-		else {
-			const savedPorts = await loadPortState(secretsRoot);
-			const ports = {};
-			for (const mapping of mappings) {
-				const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-				if (containerPort !== null) ports[mapping.envVar] = containerPort;
-				else {
-					const saved = savedPorts[mapping.envVar];
-					if (saved !== void 0) ports[mapping.envVar] = saved;
-				}
-			}
-			resolvedPorts = {
-				dockerEnv: {},
-				ports,
-				mappings
-			};
-		}
-		if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-		else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-		if (Object.keys(resolvedPorts.ports).length > 0) {
-			const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-			Object.assign(credentials, rewritten);
-			logger$1.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		Object.assign(credentials, depEnv);
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = require_fullstack_secrets.generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
-	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
-	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo
-	};
-}
-
-//#endregion
-//#region src/setup/index.ts
-const logger = console;
-/**
-* Setup development environment.
-*
-* Orchestrates:
-* 1. Load workspace config
-* 2. Resolve secrets (local → SSM → generate fresh)
-* 3. Write docker/.env from secrets
-* 4. Start Docker services
-*/
-async function setupCommand(options = {}) {
-	const stage = options.stage ?? "development";
-	logger.log("\n🔧 Setting up development environment...\n");
-	let loadedConfig;
-	try {
-		loadedConfig = await require_config.loadWorkspaceConfig();
-	} catch {
-		logger.error("❌ No gkm.config.ts found. Run this command from a workspace root.");
-		process.exit(1);
-	}
-	const { workspace } = loadedConfig;
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	logger.log(`📦 Workspace: ${workspace.name}`);
-	logger.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
-	logger.log(`🔑 Stage: ${stage}\n`);
-	const secrets = await resolveSecrets(stage, workspace, options);
-	if (!secrets) {
-		logger.error("❌ Failed to resolve secrets. Exiting.");
-		process.exit(1);
-	}
-	if (isMultiApp && workspace.services.db) {
-		await require_fullstack_secrets.writeDockerEnvFromSecrets(secrets, workspace.root);
-		logger.log("📄 Generated docker/.env with database passwords");
-	}
-	if (!options.skipDocker) {
-		const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
-		if ((0, node_fs.existsSync)(composeFile)) {
-			logger.log("");
-			const resolvedPorts = await resolveServicePorts(workspace.root);
-			await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
-		} else logger.log("⚠️  No docker-compose.yml found. Skipping Docker services.");
-	}
-	printSummary(workspace, stage);
-}
-/**
-* Resolve secrets with priority:
-* 1. Local secrets exist → use them (preserves manual additions)
-* 2. SSM configured and has secrets → pull and use
-* 3. Neither → generate fresh secrets
-*
-* --force skips checks 1 and 2 and always regenerates.
-*/
-async function resolveSecrets(stage, workspace, options) {
-	if (options.force) {
-		logger.log("🔐 Generating fresh secrets (--force)...");
-		return generateFreshSecrets(stage, workspace, options);
-	}
-	if (require_storage.secretsExist(stage, workspace.root)) {
-		logger.log("🔐 Using existing local secrets");
-		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			const reconciled = reconcileSecrets(secrets, workspace);
-			if (reconciled) await require_storage.writeStageSecrets(reconciled, workspace.root);
-			return reconciled ?? secrets;
-		}
-	}
-	if (require_sync.isSSMConfigured(workspace)) {
-		logger.log("☁️  Checking for remote secrets in SSM...");
-		try {
-			const remoteSecrets = await require_sync.pullSecrets(stage, workspace);
-			if (remoteSecrets) {
-				logger.log("✅ Pulled secrets from SSM");
-				await require_storage.writeStageSecrets(remoteSecrets, workspace.root);
-				return remoteSecrets;
-			}
-			logger.log("   No remote secrets found");
-		} catch (error) {
-			logger.warn(`⚠️  Failed to pull from SSM: ${error.message}`);
-		}
-	}
-	logger.log("🔐 Generating fresh development secrets...");
-	return generateFreshSecrets(stage, workspace, options);
-}
-/**
-* Reconcile existing secrets with expected workspace-derived keys.
-* Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.
-* Returns the updated secrets if changes were made, or null if no changes needed.
-* @internal Exported for testing
-*/
-function reconcileSecrets(secrets, workspace) {
-	let changed = false;
-	let result = { ...secrets };
-	const serviceMap = [
-		{
-			key: "db",
-			name: "postgres"
-		},
-		{
-			key: "cache",
-			name: "redis"
-		},
-		{
-			key: "storage",
-			name: "minio"
-		},
-		{
-			key: "mail",
-			name: "mailpit"
-		}
-	];
-	for (const { key, name } of serviceMap) if (workspace.services[key] && !result.services[name]) {
-		const creds = require_fullstack_secrets.generateServiceCredentials(name);
-		if (name === "minio") {
-			creds.bucket = workspace.name;
-			creds.username = workspace.name;
-		}
-		result = {
-			...result,
-			services: {
-				...result.services,
-				[name]: creds
-			}
-		};
-		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, result.eventsBackend);
-		logger.log(`   🔄 Adding missing service credentials: ${name}`);
-		changed = true;
-	}
-	if (result.services.postgres && !result.services.pgboss) {
-		result = {
-			...result,
-			services: {
-				...result.services,
-				pgboss: {
-					host: result.services.postgres.host,
-					port: result.services.postgres.port,
-					username: "pgboss",
-					password: require_fullstack_secrets.generateSecurePassword(),
-					database: result.services.postgres.database ?? "app"
-				}
-			}
-		};
-		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, result.eventsBackend);
-		logger.log("   🔄 Adding missing service credentials: pgboss");
-		changed = true;
-	}
-	const eventsBackend = workspace.services.events;
-	if (eventsBackend && result.eventsBackend !== eventsBackend) {
-		result.eventsBackend = eventsBackend;
-		if (eventsBackend === "sns" && !result.services.localstack) {
-			result = {
-				...result,
-				services: {
-					...result.services,
-					localstack: require_fullstack_secrets.generateLocalStackCredentials()
-				}
-			};
-			logger.log("   🔄 Adding missing service credentials: localstack");
-			changed = true;
-		}
-		if (eventsBackend === "rabbitmq" && !result.services.rabbitmq) {
-			result = {
-				...result,
-				services: {
-					...result.services,
-					rabbitmq: require_fullstack_secrets.generateServiceCredentials("rabbitmq")
-				}
-			};
-			logger.log("   🔄 Adding missing service credentials: rabbitmq");
-			changed = true;
-		}
-		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, eventsBackend);
-		changed = true;
-	}
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (isMultiApp) {
-		const expected = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
-		const missing = {};
-		for (const [key, value] of Object.entries(expected)) if (!(key in result.custom)) missing[key] = value;
-		if (Object.keys(missing).length > 0) {
-			logger.log(`   🔄 Adding missing secrets: ${Object.keys(missing).join(", ")}`);
-			result = {
-				...result,
-				custom: {
-					...result.custom,
-					...missing
-				}
-			};
-			changed = true;
-		}
-	}
-	if (!changed) return null;
-	return {
-		...result,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Build a fresh StageSecrets object for a workspace: service credentials,
-* connection URLs, and custom secrets. Pure — does not write to disk or touch
-* SSM. Service passwords are freshly randomized, so the result must be the same
-* one used to start the matching Docker containers.
-* @internal Exported for reuse by `gkm test` auto-setup.
-*/
-function createFreshWorkspaceSecrets(stage, workspace) {
-	const serviceNames = [];
-	if (workspace.services.db) serviceNames.push("postgres");
-	if (workspace.services.cache) serviceNames.push("redis");
-	if (workspace.services.storage) serviceNames.push("minio");
-	if (workspace.services.mail) serviceNames.push("mailpit");
-	if (workspace.services.events === "sns") serviceNames.push("localstack");
-	if (workspace.services.events === "rabbitmq") serviceNames.push("rabbitmq");
-	const secrets = require_fullstack_secrets.createStageSecrets(stage, serviceNames, {
-		projectName: workspace.name,
-		eventsBackend: workspace.services.events
-	});
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (isMultiApp) secrets.custom = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
-	else secrets.custom = {
-		NODE_ENV: "development",
-		PORT: "3000",
-		LOG_LEVEL: "debug",
-		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
-	};
-	return secrets;
-}
-/**
-* Ensure a usable secret set exists for a stage, generating a fresh one from the
-* workspace config when none is present. No-op if secrets already exist.
-*
-* Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a
-* committed secrets file or a shared encryption key — the stage is regenerated
-* from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.
-*
-* @returns true if fresh secrets were generated, false if existing ones were kept
-*/
-async function ensureStageSecrets(stage, cwd = process.cwd()) {
-	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
-	if (require_storage.secretsExist(stage, workspace.root)) return false;
-	const secrets = createFreshWorkspaceSecrets(stage, workspace);
-	await require_storage.writeStageSecrets(secrets, workspace.root);
-	return true;
-}
-/**
-* Generate fresh secrets for the workspace.
-*/
-async function generateFreshSecrets(stage, workspace, options) {
-	const secrets = createFreshWorkspaceSecrets(stage, workspace);
-	await require_storage.writeStageSecrets(secrets, workspace.root);
-	logger.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (require_sync.isSSMConfigured(workspace) && !options.yes) {
-		const { shouldPush } = await (0, prompts.default)({
-			type: "confirm",
-			name: "shouldPush",
-			message: "Push secrets to SSM for team sharing?",
-			initial: true
-		});
-		if (shouldPush) try {
-			await require_sync.pushSecrets(stage, workspace);
-			logger.log("☁️  Secrets pushed to SSM");
-		} catch (error) {
-			logger.warn(`⚠️  Failed to push to SSM: ${error.message}`);
-		}
-	}
-	return secrets;
-}
-/**
-* Print setup summary with next steps.
-*/
-function printSummary(workspace, stage) {
-	logger.log(`\n${"─".repeat(50)}`);
-	logger.log("\n✅ Development environment ready!\n");
-	logger.log("📋 Apps:");
-	for (const [name, app] of Object.entries(workspace.apps)) {
-		const icon = app.type === "web" ? "🌐" : app.type === "mobile" ? "📱" : "🔧";
-		logger.log(`   ${icon} ${name} → http://localhost:${app.port}`);
-	}
-	logger.log("\n🚀 Next steps:");
-	logger.log("   gkm dev                    # Start all apps");
-	logger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);
-	logger.log("");
-}
-
-//#endregion
-Object.defineProperty(exports, 'createCredentialsPreload', {
-  enumerable: true,
-  get: function () {
-    return createCredentialsPreload;
-  }
-});
-Object.defineProperty(exports, 'createEntryWrapper', {
-  enumerable: true,
-  get: function () {
-    return createEntryWrapper;
-  }
-});
-Object.defineProperty(exports, 'createFreshWorkspaceSecrets', {
-  enumerable: true,
-  get: function () {
-    return createFreshWorkspaceSecrets;
-  }
-});
-Object.defineProperty(exports, 'ensureStageSecrets', {
-  enumerable: true,
-  get: function () {
-    return ensureStageSecrets;
-  }
-});
-Object.defineProperty(exports, 'findAvailablePort', {
-  enumerable: true,
-  get: function () {
-    return findAvailablePort;
-  }
-});
-Object.defineProperty(exports, 'isPortAvailable', {
-  enumerable: true,
-  get: function () {
-    return isPortAvailable;
-  }
-});
-Object.defineProperty(exports, 'loadEnvFiles', {
-  enumerable: true,
-  get: function () {
-    return loadEnvFiles;
-  }
-});
-Object.defineProperty(exports, 'loadSecretsForApp', {
-  enumerable: true,
-  get: function () {
-    return loadSecretsForApp;
-  }
-});
-Object.defineProperty(exports, 'prepareEntryCredentials', {
-  enumerable: true,
-  get: function () {
-    return prepareEntryCredentials;
-  }
-});
-Object.defineProperty(exports, 'reconcileSecrets', {
-  enumerable: true,
-  get: function () {
-    return reconcileSecrets;
-  }
-});
-Object.defineProperty(exports, 'resolveServicePorts', {
-  enumerable: true,
-  get: function () {
-    return resolveServicePorts;
-  }
-});
-Object.defineProperty(exports, 'rewriteUrlsWithPorts', {
-  enumerable: true,
-  get: function () {
-    return rewriteUrlsWithPorts;
-  }
-});
-Object.defineProperty(exports, 'setupCommand', {
-  enumerable: true,
-  get: function () {
-    return setupCommand;
-  }
-});
-Object.defineProperty(exports, 'startWorkspaceServices', {
-  enumerable: true,
-  get: function () {
-    return startWorkspaceServices;
-  }
-});
-//# sourceMappingURL=setup-WZ-xqAQO.cjs.map