@geekmidas/cli 0.10.0 → 0.13.0

package/dist/index.mjs

@@ -1,13 +1,17 @@
 #!/usr/bin/env -S npx tsx
-import { loadConfig, parseModuleConfig } from "./config-BrkUalUh.mjs";
-import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-CZLI4QTr.mjs";
-import { generateReactQueryCommand } from "./openapi-react-query-CcciaVu5.mjs";
-import { join, relative } from "path";
+import { loadConfig, parseModuleConfig } from "./config-DYULeEv8.mjs";
+import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-BfFlOBCG.mjs";
+import { generateReactQueryCommand } from "./openapi-react-query-B6XTeGqS.mjs";
+import { maskPassword, readStageSecrets, secretsExist, setCustomSecret, writeStageSecrets } from "./storage-kSxTjkNb.mjs";
+import { createRequire } from "node:module";
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, join, parse, relative, resolve } from "node:path";
 import { Command } from "commander";
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, join as join$1, relative as relative$1, resolve } from "node:path";
+import { stdin, stdout } from "node:process";
+import * as readline from "node:readline/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { execSync, spawn } from "node:child_process";
-import { existsSync } from "node:fs";
 import { createServer } from "node:net";
 import chokidar from "chokidar";
 import { config } from "dotenv";
@@ -16,10 +20,15 @@ import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
 import prompts from "prompts";
+import { randomBytes } from "node:crypto";
 
+//#region rolldown:runtime
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+//#endregion
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "0.10.0";
+var version = "0.13.0";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -99,6 +108,227 @@ var package_default = {
 	peerDependenciesMeta
 };
 
+//#endregion
+//#region src/auth/credentials.ts
+/**
+* Get the path to the credentials directory
+*/
+function getCredentialsDir(options) {
+	const root = options?.root ?? homedir();
+	return join(root, ".gkm");
+}
+/**
+* Get the path to the credentials file
+*/
+function getCredentialsPath(options) {
+	return join(getCredentialsDir(options), "credentials.json");
+}
+/**
+* Ensure the credentials directory exists
+*/
+function ensureCredentialsDir(options) {
+	const dir = getCredentialsDir(options);
+	if (!existsSync(dir)) mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+}
+/**
+* Read stored credentials from disk
+*/
+async function readCredentials(options) {
+	const path = getCredentialsPath(options);
+	if (!existsSync(path)) return {};
+	try {
+		const content = await readFile(path, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return {};
+	}
+}
+/**
+* Write credentials to disk
+*/
+async function writeCredentials(credentials, options) {
+	ensureCredentialsDir(options);
+	const path = getCredentialsPath(options);
+	await writeFile(path, JSON.stringify(credentials, null, 2), { mode: 384 });
+}
+/**
+* Store Dokploy credentials
+*/
+async function storeDokployCredentials(token, endpoint, options) {
+	const credentials = await readCredentials(options);
+	credentials.dokploy = {
+		token,
+		endpoint,
+		storedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await writeCredentials(credentials, options);
+}
+/**
+* Get stored Dokploy credentials
+*/
+async function getDokployCredentials(options) {
+	const credentials = await readCredentials(options);
+	if (!credentials.dokploy) return null;
+	return {
+		token: credentials.dokploy.token,
+		endpoint: credentials.dokploy.endpoint
+	};
+}
+/**
+* Remove Dokploy credentials
+*/
+async function removeDokployCredentials(options) {
+	const credentials = await readCredentials(options);
+	if (!credentials.dokploy) return false;
+	delete credentials.dokploy;
+	await writeCredentials(credentials, options);
+	return true;
+}
+/**
+* Get Dokploy API token, checking stored credentials first, then environment
+*/
+async function getDokployToken(options) {
+	const envToken = process.env.DOKPLOY_API_TOKEN;
+	if (envToken) return envToken;
+	const stored = await getDokployCredentials(options);
+	if (stored) return stored.token;
+	return null;
+}
+
+//#endregion
+//#region src/auth/index.ts
+const logger$9 = console;
+/**
+* Validate Dokploy token by making a test API call
+*/
+async function validateDokployToken(endpoint, token) {
+	try {
+		const response = await fetch(`${endpoint}/api/project.all`, {
+			method: "GET",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`
+			}
+		});
+		return response.ok;
+	} catch {
+		return false;
+	}
+}
+/**
+* Prompt for input (handles both TTY and non-TTY)
+*/
+async function prompt(message, hidden = false) {
+	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please provide --token option.");
+	const rl = readline.createInterface({
+		input: stdin,
+		output: stdout
+	});
+	try {
+		if (hidden) {
+			process.stdout.write(message);
+			return new Promise((resolve$1) => {
+				let value = "";
+				const onData = (char) => {
+					const c = char.toString();
+					if (c === "\n" || c === "\r") {
+						process.stdin.removeListener("data", onData);
+						process.stdin.setRawMode(false);
+						process.stdout.write("\n");
+						resolve$1(value);
+					} else if (c === "") process.exit(1);
+					else if (c === "" || c === "\b") {
+						if (value.length > 0) value = value.slice(0, -1);
+					} else value += c;
+				};
+				process.stdin.setRawMode(true);
+				process.stdin.resume();
+				process.stdin.on("data", onData);
+			});
+		} else return await rl.question(message);
+	} finally {
+		rl.close();
+	}
+}
+/**
+* Login to a service
+*/
+async function loginCommand(options) {
+	const { service, token: providedToken, endpoint: providedEndpoint } = options;
+	if (service === "dokploy") {
+		logger$9.log("\n🔐 Logging in to Dokploy...\n");
+		let endpoint = providedEndpoint;
+		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ");
+		endpoint = endpoint.replace(/\/$/, "");
+		try {
+			new URL(endpoint);
+		} catch {
+			logger$9.error("Invalid URL format");
+			process.exit(1);
+		}
+		let token = providedToken;
+		if (!token) {
+			logger$9.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			token = await prompt("API Token: ", true);
+		}
+		if (!token) {
+			logger$9.error("Token is required");
+			process.exit(1);
+		}
+		logger$9.log("\nValidating credentials...");
+		const isValid = await validateDokployToken(endpoint, token);
+		if (!isValid) {
+			logger$9.error("\n✗ Invalid credentials. Please check your token and try again.");
+			process.exit(1);
+		}
+		await storeDokployCredentials(token, endpoint);
+		logger$9.log("\n✓ Successfully logged in to Dokploy!");
+		logger$9.log(`  Endpoint: ${endpoint}`);
+		logger$9.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$9.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+	}
+}
+/**
+* Logout from a service
+*/
+async function logoutCommand(options) {
+	const { service = "dokploy" } = options;
+	if (service === "all") {
+		const dokployRemoved = await removeDokployCredentials();
+		if (dokployRemoved) logger$9.log("\n✓ Logged out from all services");
+		else logger$9.log("\nNo stored credentials found");
+		return;
+	}
+	if (service === "dokploy") {
+		const removed = await removeDokployCredentials();
+		if (removed) logger$9.log("\n✓ Logged out from Dokploy");
+		else logger$9.log("\nNo Dokploy credentials found");
+	}
+}
+/**
+* Show current login status
+*/
+async function whoamiCommand() {
+	logger$9.log("\n📋 Current credentials:\n");
+	const dokploy = await getDokployCredentials();
+	if (dokploy) {
+		logger$9.log("  Dokploy:");
+		logger$9.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$9.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$9.log("  Dokploy: Not logged in");
+	logger$9.log(`\n  Credentials file: ${getCredentialsPath()}`);
+}
+/**
+* Mask a token for display
+*/
+function maskToken(token) {
+	if (token.length <= 8) return "****";
+	return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+
 //#endregion
 //#region src/build/providerResolver.ts
 /**
@@ -175,22 +405,22 @@ function isEnabled(config$1) {
 var CronGenerator = class extends ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$3 = console;
+		const logger$10 = console;
 		const cronInfos = [];
 		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
-		const cronsDir = join$1(outputDir, "crons");
+		const cronsDir = join(outputDir, "crons");
 		await mkdir(cronsDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
 			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context);
 			cronInfos.push({
 				name: key,
-				handler: relative$1(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				schedule: construct.schedule || "rate(1 hour)",
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment()
 			});
-			logger$3.log(`Generated cron handler: ${key}`);
+			logger$10.log(`Generated cron handler: ${key}`);
 		}
 		return cronInfos;
 	}
@@ -199,11 +429,11 @@ var CronGenerator = class extends ConstructGenerator {
 	}
 	async generateCronHandler(outputDir, sourceFile, exportName, context) {
 		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join$1(outputDir, handlerFileName);
-		const relativePath = relative$1(dirname(handlerPath), sourceFile);
+		const handlerPath = join(outputDir, handlerFileName);
+		const relativePath = relative(dirname(handlerPath), sourceFile);
 		const importPath = relativePath.replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative$1(dirname(handlerPath), context.envParserPath);
-		const relativeLoggerPath = relative$1(dirname(handlerPath), context.loggerPath);
+		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
+		const relativeLoggerPath = relative(dirname(handlerPath), context.loggerPath);
 		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/crons';
 import { ${exportName} } from '${importPath}';
 import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
@@ -226,31 +456,31 @@ var FunctionGenerator = class extends ConstructGenerator {
 	}
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$3 = console;
+		const logger$10 = console;
 		const functionInfos = [];
 		if (constructs.length === 0 || provider !== "aws-lambda") return functionInfos;
-		const functionsDir = join$1(outputDir, "functions");
+		const functionsDir = join(outputDir, "functions");
 		await mkdir(functionsDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
 			const handlerFile = await this.generateFunctionHandler(functionsDir, path.relative, key, context);
 			functionInfos.push({
 				name: key,
-				handler: relative$1(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment()
 			});
-			logger$3.log(`Generated function handler: ${key}`);
+			logger$10.log(`Generated function handler: ${key}`);
 		}
 		return functionInfos;
 	}
 	async generateFunctionHandler(outputDir, sourceFile, exportName, context) {
 		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join$1(outputDir, handlerFileName);
-		const relativePath = relative$1(dirname(handlerPath), sourceFile);
+		const handlerPath = join(outputDir, handlerFileName);
+		const relativePath = relative(dirname(handlerPath), sourceFile);
 		const importPath = relativePath.replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative$1(dirname(handlerPath), context.envParserPath);
-		const relativeLoggerPath = relative$1(dirname(handlerPath), context.loggerPath);
+		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
+		const relativeLoggerPath = relative(dirname(handlerPath), context.loggerPath);
 		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/functions';
 import { ${exportName} } from '${importPath}';
 import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
@@ -273,37 +503,37 @@ var SubscriberGenerator = class extends ConstructGenerator {
 	}
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$3 = console;
+		const logger$10 = console;
 		const subscriberInfos = [];
 		if (provider === "server") {
 			await this.generateServerSubscribersFile(outputDir, constructs);
-			logger$3.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
+			logger$10.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
 			return subscriberInfos;
 		}
 		if (constructs.length === 0) return subscriberInfos;
 		if (provider !== "aws-lambda") return subscriberInfos;
-		const subscribersDir = join$1(outputDir, "subscribers");
+		const subscribersDir = join(outputDir, "subscribers");
 		await mkdir(subscribersDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
 			const handlerFile = await this.generateSubscriberHandler(subscribersDir, path.relative, key, construct, context);
 			subscriberInfos.push({
 				name: key,
-				handler: relative$1(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				handler: relative(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				subscribedEvents: construct.subscribedEvents || [],
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment()
 			});
-			logger$3.log(`Generated subscriber handler: ${key}`);
+			logger$10.log(`Generated subscriber handler: ${key}`);
 		}
 		return subscriberInfos;
 	}
 	async generateSubscriberHandler(outputDir, sourceFile, exportName, _subscriber, context) {
 		const handlerFileName = `${exportName}.ts`;
-		const handlerPath = join$1(outputDir, handlerFileName);
-		const relativePath = relative$1(dirname(handlerPath), sourceFile);
+		const handlerPath = join(outputDir, handlerFileName);
+		const relativePath = relative(dirname(handlerPath), sourceFile);
 		const importPath = relativePath.replace(/\.ts$/, ".js");
-		const relativeEnvParserPath = relative$1(dirname(handlerPath), context.envParserPath);
+		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
 		const content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
@@ -318,13 +548,13 @@ export const handler = adapter.handler;
 	async generateServerSubscribersFile(outputDir, subscribers) {
 		await mkdir(outputDir, { recursive: true });
 		const subscribersFileName = "subscribers.ts";
-		const subscribersPath = join$1(outputDir, subscribersFileName);
+		const subscribersPath = join(outputDir, subscribersFileName);
 		const importsByFile = /* @__PURE__ */ new Map();
 		for (const { path, key } of subscribers) {
-			const relativePath = relative$1(dirname(subscribersPath), path.relative);
+			const relativePath = relative(dirname(subscribersPath), path.relative);
 			const importPath = relativePath.replace(/\.ts$/, ".js");
 			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
-			importsByFile.get(importPath).push(key);
+			importsByFile.get(importPath)?.push(key);
 		}
 		const imports = Array.from(importsByFile.entries()).map(([importPath, exports$1]) => `import { ${exports$1.join(", ")} } from '${importPath}';`).join("\n");
 		const allExportNames = subscribers.map(({ key }) => key);
@@ -379,7 +609,7 @@ export async function setupSubscribers(
     return;
   }
 
-  const serviceDiscovery = ServiceDiscovery.getInstance(logger, envParser);
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
 
   // Create connection once, outside the loop (more efficient)
   // EventConnectionFactory automatically determines the right connection type
@@ -460,7 +690,7 @@ export async function setupSubscribers(
 
 //#endregion
 //#region src/dev/index.ts
-const logger$2 = console;
+const logger$8 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -511,7 +741,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$8.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -581,33 +811,61 @@ function normalizeHooksConfig(config$1) {
 	const resolvedPath = resolve(process.cwd(), serverPath);
 	return { serverHooksPath: resolvedPath };
 }
+/**
+* Normalize production configuration
+* @internal Exported for testing
+*/
+function normalizeProductionConfig(cliProduction, configProduction) {
+	if (!cliProduction) return void 0;
+	const config$1 = configProduction ?? {};
+	return {
+		enabled: true,
+		bundle: config$1.bundle ?? true,
+		minify: config$1.minify ?? true,
+		healthCheck: config$1.healthCheck ?? "/health",
+		gracefulShutdown: config$1.gracefulShutdown ?? true,
+		external: config$1.external ?? [],
+		subscribers: config$1.subscribers ?? "exclude",
+		openapi: config$1.openapi ?? false,
+		optimizedHandlers: config$1.optimizedHandlers ?? true
+	};
+}
+/**
+* Get production config from GkmConfig
+* @internal
+*/
+function getProductionConfigFromGkm(config$1) {
+	const serverConfig = config$1.providers?.server;
+	if (typeof serverConfig === "object") return serverConfig.production;
+	return void 0;
+}
 async function devCommand(options) {
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$2.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$8.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const config$1 = await loadConfig();
 	if (config$1.env) {
 		const { loaded, missing } = loadEnvFiles(config$1.env);
-		if (loaded.length > 0) logger$2.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$2.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (loaded.length > 0) logger$8.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$8.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const resolved = resolveProviders(config$1, { provider: "server" });
-	logger$2.log("🚀 Starting development server...");
-	logger$2.log(`Loading routes from: ${config$1.routes}`);
-	if (config$1.functions) logger$2.log(`Loading functions from: ${config$1.functions}`);
-	if (config$1.crons) logger$2.log(`Loading crons from: ${config$1.crons}`);
-	if (config$1.subscribers) logger$2.log(`Loading subscribers from: ${config$1.subscribers}`);
-	logger$2.log(`Using envParser: ${config$1.envParser}`);
+	logger$8.log("🚀 Starting development server...");
+	logger$8.log(`Loading routes from: ${config$1.routes}`);
+	if (config$1.functions) logger$8.log(`Loading functions from: ${config$1.functions}`);
+	if (config$1.crons) logger$8.log(`Loading crons from: ${config$1.crons}`);
+	if (config$1.subscribers) logger$8.log(`Loading subscribers from: ${config$1.subscribers}`);
+	logger$8.log(`Using envParser: ${config$1.envParser}`);
 	const { path: envParserPath, importPattern: envParserImportPattern } = parseModuleConfig(config$1.envParser, "envParser");
 	const { path: loggerPath, importPattern: loggerImportPattern } = parseModuleConfig(config$1.logger, "logger");
 	const telescope = normalizeTelescopeConfig(config$1.telescope);
-	if (telescope) logger$2.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$8.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = normalizeStudioConfig(config$1.studio);
-	if (studio) logger$2.log(`🗄️  Studio enabled at ${studio.path}`);
+	if (studio) logger$8.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config$1.hooks);
-	if (hooks) logger$2.log(`🪝 Server hooks enabled from ${config$1.hooks?.server}`);
+	if (hooks) logger$8.log(`🪝 Server hooks enabled from ${config$1.hooks?.server}`);
 	const openApiConfig = resolveOpenApiConfig(config$1);
 	const enableOpenApi = openApiConfig.enabled || resolved.enableOpenApi;
-	if (enableOpenApi) logger$2.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH}`);
+	if (enableOpenApi) logger$8.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH}`);
 	const buildContext = {
 		envParserPath,
 		envParserImportPattern,
@@ -636,7 +894,7 @@ async function devCommand(options) {
 		...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []
 	].flat().filter((p) => typeof p === "string");
 	const normalizedPatterns = watchPatterns.map((p) => p.startsWith("./") ? p.slice(2) : p);
-	logger$2.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
+	logger$8.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
 	const resolvedFiles = await fg(normalizedPatterns, {
 		cwd: process.cwd(),
 		absolute: false,
@@ -646,32 +904,32 @@ async function devCommand(options) {
 		const parts = f.split("/");
 		return parts.slice(0, -1).join("/");
 	}))];
-	logger$2.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
+	logger$8.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
 	const watcher = chokidar.watch([...resolvedFiles, ...dirsToWatch], {
-		ignored: /(^|[\/\\])\../,
+		ignored: /(^|[/\\])\../,
 		persistent: true,
 		ignoreInitial: true,
 		cwd: process.cwd()
 	});
 	watcher.on("ready", () => {
-		logger$2.log("🔍 File watcher ready");
+		logger$8.log("🔍 File watcher ready");
 	});
 	watcher.on("error", (error) => {
-		logger$2.error("❌ Watcher error:", error);
+		logger$8.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$2.log(`📝 File changed: ${path}`);
+		logger$8.log(`📝 File changed: ${path}`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
-				logger$2.log("🔄 Rebuilding...");
+				logger$8.log("🔄 Rebuilding...");
 				await buildServer(config$1, buildContext, resolved.providers[0], enableOpenApi);
 				if (enableOpenApi) await generateOpenApi(config$1, { silent: true });
-				logger$2.log("✅ Rebuild complete, restarting server...");
+				logger$8.log("✅ Rebuild complete, restarting server...");
 				await devServer.restart();
 			} catch (error) {
-				logger$2.error("❌ Rebuild failed:", error.message);
+				logger$8.error("❌ Rebuild failed:", error.message);
 			}
 		}, 300);
 	});
@@ -679,9 +937,9 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$2.log("\n🛑 Shutting down...");
+		logger$8.log("\n🛑 Shutting down...");
 		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
-			logger$2.error("Error during shutdown:", err);
+			logger$8.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -700,7 +958,7 @@ async function buildServer(config$1, context, provider, enableOpenApi) {
 		config$1.crons ? cronGenerator.load(config$1.crons) : [],
 		config$1.subscribers ? subscriberGenerator.load(config$1.subscribers) : []
 	]);
-	const outputDir = join$1(process.cwd(), ".gkm", provider);
+	const outputDir = join(process.cwd(), ".gkm", provider);
 	await mkdir(outputDir, { recursive: true });
 	await Promise.all([
 		endpointGenerator.build(context, allEndpoints, outputDir, {
@@ -734,11 +992,11 @@ var DevServer = class {
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$2.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			if (this.actualPort !== this.requestedPort) logger$8.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
-		const serverEntryPath = join$1(process.cwd(), ".gkm", this.provider, "server.ts");
+		const serverEntryPath = join(process.cwd(), ".gkm", this.provider, "server.ts");
 		await this.createServerEntry();
-		logger$2.log(`\n✨ Starting server on port ${this.actualPort}...`);
+		logger$8.log(`\n✨ Starting server on port ${this.actualPort}...`);
 		this.serverProcess = spawn("npx", [
 			"tsx",
 			serverEntryPath,
@@ -754,18 +1012,18 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$2.error("❌ Server error:", error);
+			logger$8.error("❌ Server error:", error);
 		});
 		this.serverProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$2.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$8.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve$1) => setTimeout(resolve$1, 1e3));
 		if (this.isRunning) {
-			logger$2.log(`\n🎉 Server running at http://localhost:${this.actualPort}`);
-			if (this.enableOpenApi) logger$2.log(`📚 API Docs available at http://localhost:${this.actualPort}/__docs`);
-			if (this.telescope) logger$2.log(`🔭 Telescope available at http://localhost:${this.actualPort}${this.telescope.path}`);
-			if (this.studio) logger$2.log(`🗄️  Studio available at http://localhost:${this.actualPort}${this.studio.path}`);
+			logger$8.log(`\n🎉 Server running at http://localhost:${this.actualPort}`);
+			if (this.enableOpenApi) logger$8.log(`📚 API Docs available at http://localhost:${this.actualPort}/__docs`);
+			if (this.telescope) logger$8.log(`🔭 Telescope available at http://localhost:${this.actualPort}${this.telescope.path}`);
+			if (this.studio) logger$8.log(`🗄️  Studio available at http://localhost:${this.actualPort}${this.studio.path}`);
 		}
 	}
 	async stop() {
@@ -803,9 +1061,9 @@ var DevServer = class {
 	}
 	async createServerEntry() {
 		const { writeFile: writeFile$1 } = await import("node:fs/promises");
-		const { relative: relative$2, dirname: dirname$1 } = await import("node:path");
-		const serverPath = join$1(process.cwd(), ".gkm", this.provider, "server.ts");
-		const relativeAppPath = relative$2(dirname$1(serverPath), join$1(dirname$1(serverPath), "app.js"));
+		const { relative: relative$1, dirname: dirname$1 } = await import("node:path");
+		const serverPath = join(process.cwd(), ".gkm", this.provider, "server.ts");
+		const relativeAppPath = relative$1(dirname$1(serverPath), join(dirname$1(serverPath), "app.js"));
 		const serveCode = this.runtime === "bun" ? `Bun.serve({
       port,
       fetch: app.fetch,
@@ -825,7 +1083,7 @@ var DevServer = class {
  * Development server entry point
  * This file is auto-generated by 'gkm dev'
  */
-import { createApp } from './${relativeAppPath.startsWith(".") ? relativeAppPath : "./" + relativeAppPath}';
+import { createApp } from './${relativeAppPath.startsWith(".") ? relativeAppPath : `./${relativeAppPath}`}';
 
 const port = process.argv.includes('--port')
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
@@ -851,7 +1109,7 @@ start({
 
 //#endregion
 //#region src/build/manifests.ts
-const logger$1 = console;
+const logger$7 = console;
 async function generateAwsManifest(outputDir, routes, functions, crons, subscribers) {
 	const manifestDir = join(outputDir, "manifest");
 	await mkdir(manifestDir, { recursive: true });
@@ -876,8 +1134,8 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = join(manifestDir, "aws.ts");
 	await writeFile(manifestPath, content);
-	logger$1.log(`Generated AWS manifest with ${awsRoutes.length} routes, ${functions.length} functions, ${crons.length} crons, ${subscribers.length} subscribers`);
-	logger$1.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
+	logger$7.log(`Generated AWS manifest with ${awsRoutes.length} routes, ${functions.length} functions, ${crons.length} crons, ${subscribers.length} subscribers`);
+	logger$7.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
 }
 async function generateServerManifest(outputDir, appInfo, routes, subscribers) {
 	const manifestDir = join(outputDir, "manifest");
@@ -908,35 +1166,42 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = join(manifestDir, "server.ts");
 	await writeFile(manifestPath, content);
-	logger$1.log(`Generated server manifest with ${serverRoutes.length} routes, ${serverSubscribers.length} subscribers`);
-	logger$1.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
+	logger$7.log(`Generated server manifest with ${serverRoutes.length} routes, ${serverSubscribers.length} subscribers`);
+	logger$7.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
 }
 
 //#endregion
 //#region src/build/index.ts
-const logger = console;
+const logger$6 = console;
 async function buildCommand(options) {
 	const config$1 = await loadConfig();
 	const resolved = resolveProviders(config$1, options);
-	logger.log(`Building with providers: ${resolved.providers.join(", ")}`);
-	logger.log(`Loading routes from: ${config$1.routes}`);
-	if (config$1.functions) logger.log(`Loading functions from: ${config$1.functions}`);
-	if (config$1.crons) logger.log(`Loading crons from: ${config$1.crons}`);
-	if (config$1.subscribers) logger.log(`Loading subscribers from: ${config$1.subscribers}`);
-	logger.log(`Using envParser: ${config$1.envParser}`);
+	const productionConfigFromGkm = getProductionConfigFromGkm(config$1);
+	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
+	if (production) logger$6.log(`🏭 Building for PRODUCTION`);
+	logger$6.log(`Building with providers: ${resolved.providers.join(", ")}`);
+	logger$6.log(`Loading routes from: ${config$1.routes}`);
+	if (config$1.functions) logger$6.log(`Loading functions from: ${config$1.functions}`);
+	if (config$1.crons) logger$6.log(`Loading crons from: ${config$1.crons}`);
+	if (config$1.subscribers) logger$6.log(`Loading subscribers from: ${config$1.subscribers}`);
+	logger$6.log(`Using envParser: ${config$1.envParser}`);
 	const { path: envParserPath, importPattern: envParserImportPattern } = parseModuleConfig(config$1.envParser, "envParser");
 	const { path: loggerPath, importPattern: loggerImportPattern } = parseModuleConfig(config$1.logger, "logger");
-	const telescope = normalizeTelescopeConfig(config$1.telescope);
-	if (telescope) logger.log(`🔭 Telescope enabled at ${telescope.path}`);
+	const telescope = production ? void 0 : normalizeTelescopeConfig(config$1.telescope);
+	if (telescope) logger$6.log(`🔭 Telescope enabled at ${telescope.path}`);
+	const studio = production ? void 0 : normalizeStudioConfig(config$1.studio);
+	if (studio) logger$6.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config$1.hooks);
-	if (hooks) logger.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$6.log(`🪝 Server hooks enabled`);
 	const buildContext = {
 		envParserPath,
 		envParserImportPattern,
 		loggerPath,
 		loggerImportPattern,
 		telescope,
-		hooks
+		studio,
+		hooks,
+		production
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -948,45 +1213,1250 @@ async function buildCommand(options) {
 		config$1.crons ? cronGenerator.load(config$1.crons) : [],
 		config$1.subscribers ? subscriberGenerator.load(config$1.subscribers) : []
 	]);
-	logger.log(`Found ${allEndpoints.length} endpoints`);
-	logger.log(`Found ${allFunctions.length} functions`);
-	logger.log(`Found ${allCrons.length} crons`);
-	logger.log(`Found ${allSubscribers.length} subscribers`);
+	logger$6.log(`Found ${allEndpoints.length} endpoints`);
+	logger$6.log(`Found ${allFunctions.length} functions`);
+	logger$6.log(`Found ${allCrons.length} crons`);
+	logger$6.log(`Found ${allSubscribers.length} subscribers`);
 	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0) {
-		logger.log("No endpoints, functions, crons, or subscribers found to process");
+		logger$6.log("No endpoints, functions, crons, or subscribers found to process");
+		return {};
+	}
+	const rootOutputDir = join(process.cwd(), ".gkm");
+	await mkdir(rootOutputDir, { recursive: true });
+	let result = {};
+	for (const provider of resolved.providers) {
+		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
+		if (providerResult.masterKey) result = providerResult;
+	}
+	return result;
+}
+async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
+	const outputDir = join(process.cwd(), ".gkm", provider);
+	await mkdir(outputDir, { recursive: true });
+	logger$6.log(`\nGenerating handlers for provider: ${provider}`);
+	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
+		endpointGenerator.build(context, endpoints, outputDir, {
+			provider,
+			enableOpenApi
+		}),
+		functionGenerator.build(context, functions, outputDir, { provider }),
+		cronGenerator.build(context, crons, outputDir, { provider }),
+		subscriberGenerator.build(context, subscribers, outputDir, { provider })
+	]);
+	logger$6.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
+	if (provider === "server") {
+		const routeMetadata = await Promise.all(endpoints.map(async ({ construct }) => ({
+			path: construct._path,
+			method: construct.method,
+			handler: "",
+			authorizer: construct.authorizer?.name ?? "none"
+		})));
+		const appInfo = {
+			handler: relative(process.cwd(), join(outputDir, "app.ts")),
+			endpoints: relative(process.cwd(), join(outputDir, "endpoints.ts"))
+		};
+		await generateServerManifest(rootOutputDir, appInfo, routeMetadata, subscriberInfos);
+		let masterKey;
+		if (context.production?.bundle && !skipBundle) {
+			logger$6.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await import("./bundler-DskIqW2t.mjs");
+			const allConstructs = [
+				...endpoints.map((e) => e.construct),
+				...functions.map((f) => f.construct),
+				...crons.map((c) => c.construct),
+				...subscribers.map((s) => s.construct)
+			];
+			const bundleResult = await bundleServer({
+				entryPoint: join(outputDir, "server.ts"),
+				outputDir: join(outputDir, "dist"),
+				minify: context.production.minify,
+				sourcemap: false,
+				external: context.production.external,
+				stage,
+				constructs: allConstructs
+			});
+			masterKey = bundleResult.masterKey;
+			logger$6.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			if (masterKey) {
+				logger$6.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$6.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
+			}
+		}
+		return { masterKey };
+	} else await generateAwsManifest(rootOutputDir, routes, functionInfos, cronInfos, subscriberInfos);
+	return {};
+}
+
+//#endregion
+//#region src/deploy/docker.ts
+const logger$5 = console;
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* Build Docker image
+*/
+async function buildImage(imageRef) {
+	logger$5.log(`\n🔨 Building Docker image: ${imageRef}`);
+	try {
+		execSync(`DOCKER_BUILDKIT=1 docker build -f .gkm/docker/Dockerfile -t ${imageRef} .`, {
+			cwd: process.cwd(),
+			stdio: "inherit",
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			}
+		});
+		logger$5.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef) {
+	logger$5.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		execSync(`docker push ${imageRef}`, {
+			cwd: process.cwd(),
+			stdio: "inherit"
+		});
+		logger$5.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config: config$1 } = options;
+	const imageName = config$1.imageName ?? "app";
+	const imageRef = getImageRef(config$1.registry, imageName, tag);
+	await buildImage(imageRef);
+	if (!skipPush) if (!config$1.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+	else await pushImage(imageRef);
+	logger$5.log("\n✅ Docker deployment ready!");
+	logger$5.log(`\n📋 Deployment details:`);
+	logger$5.log(`   Image: ${imageRef}`);
+	logger$5.log(`   Stage: ${stage}`);
+	if (masterKey) {
+		logger$5.log(`\n🔐 Deploy with this environment variable:`);
+		logger$5.log(`   GKM_MASTER_KEY=${masterKey}`);
+		logger$5.log("\n   Example docker run:");
+		logger$5.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
+	}
+	return {
+		imageRef,
+		masterKey
+	};
+}
+/**
+* Resolve Docker deploy config from gkm config
+*/
+function resolveDockerConfig$1(config$1) {
+	return {
+		registry: config$1.docker?.registry,
+		imageName: config$1.docker?.imageName
+	};
+}
+
+//#endregion
+//#region src/deploy/dokploy.ts
+const logger$4 = console;
+/**
+* Get the Dokploy API token from stored credentials or environment
+*/
+async function getApiToken$1() {
+	const token = await getDokployToken();
+	if (!token) throw new Error("Dokploy credentials not found.\nRun \"gkm login --service dokploy\" to authenticate, or set DOKPLOY_API_TOKEN.");
+	return token;
+}
+/**
+* Make a request to the Dokploy API
+*/
+async function dokployRequest$1(endpoint, baseUrl, token, body) {
+	const url = `${baseUrl}/api/${endpoint}`;
+	const response = await fetch(url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${token}`
+		},
+		body: JSON.stringify(body)
+	});
+	if (!response.ok) {
+		let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
+		try {
+			const errorBody = await response.json();
+			if (errorBody.message) errorMessage = `Dokploy API error: ${errorBody.message}`;
+			if (errorBody.issues?.length) errorMessage += `\n  Issues: ${errorBody.issues.map((i) => i.message).join(", ")}`;
+		} catch {}
+		throw new Error(errorMessage);
+	}
+	return response.json();
+}
+/**
+* Update application environment variables
+*/
+async function updateEnvironment(baseUrl, token, applicationId, envVars) {
+	logger$4.log("  Updating environment variables...");
+	const envString = Object.entries(envVars).map(([key, value]) => `${key}=${value}`).join("\n");
+	await dokployRequest$1("application.update", baseUrl, token, {
+		applicationId,
+		env: envString
+	});
+	logger$4.log("  ✓ Environment variables updated");
+}
+/**
+* Trigger application deployment
+*/
+async function triggerDeploy(baseUrl, token, applicationId) {
+	logger$4.log("  Triggering deployment...");
+	await dokployRequest$1("application.deploy", baseUrl, token, { applicationId });
+	logger$4.log("  ✓ Deployment triggered");
+}
+/**
+* Deploy to Dokploy
+*/
+async function deployDokploy(options) {
+	const { stage, imageRef, masterKey, config: config$1 } = options;
+	logger$4.log(`\n🎯 Deploying to Dokploy...`);
+	logger$4.log(`   Endpoint: ${config$1.endpoint}`);
+	logger$4.log(`   Application: ${config$1.applicationId}`);
+	const token = await getApiToken$1();
+	const envVars = {};
+	if (masterKey) envVars.GKM_MASTER_KEY = masterKey;
+	if (Object.keys(envVars).length > 0) await updateEnvironment(config$1.endpoint, token, config$1.applicationId, envVars);
+	await triggerDeploy(config$1.endpoint, token, config$1.applicationId);
+	logger$4.log("\n✅ Dokploy deployment initiated!");
+	logger$4.log(`\n📋 Deployment details:`);
+	logger$4.log(`   Image: ${imageRef}`);
+	logger$4.log(`   Stage: ${stage}`);
+	logger$4.log(`   Application ID: ${config$1.applicationId}`);
+	if (masterKey) logger$4.log(`\n🔐 GKM_MASTER_KEY has been set in Dokploy environment`);
+	const deploymentUrl = `${config$1.endpoint}/project/${config$1.projectId}`;
+	logger$4.log(`\n🔗 View deployment: ${deploymentUrl}`);
+	return {
+		imageRef,
+		masterKey,
+		url: deploymentUrl
+	};
+}
+/**
+* Validate Dokploy configuration
+*/
+function validateDokployConfig(config$1) {
+	if (!config$1) return false;
+	const required = [
+		"endpoint",
+		"projectId",
+		"applicationId"
+	];
+	const missing = required.filter((key) => !config$1[key]);
+	if (missing.length > 0) throw new Error(`Missing Dokploy configuration: ${missing.join(", ")}\nConfigure in gkm.config.ts:
+  providers: {
+    dokploy: {
+      endpoint: 'https://dokploy.example.com',
+      projectId: 'proj_xxx',
+      applicationId: 'app_xxx',
+    },
+  }`);
+	return true;
+}
+
+//#endregion
+//#region src/deploy/index.ts
+const logger$3 = console;
+/**
+* Generate image tag from stage and timestamp
+*/
+function generateTag(stage) {
+	const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
+	return `${stage}-${timestamp}`;
+}
+/**
+* Main deploy command
+*/
+async function deployCommand(options) {
+	const { provider, stage, tag, skipPush, skipBuild } = options;
+	logger$3.log(`\n🚀 Deploying to ${provider}...`);
+	logger$3.log(`   Stage: ${stage}`);
+	const config$1 = await loadConfig();
+	const imageTag = tag ?? generateTag(stage);
+	logger$3.log(`   Tag: ${imageTag}`);
+	let masterKey;
+	if (!skipBuild) {
+		logger$3.log(`\n📦 Building for production...`);
+		const buildResult = await buildCommand({
+			provider: "server",
+			production: true,
+			stage
+		});
+		masterKey = buildResult.masterKey;
+	} else logger$3.log(`\n⏭️  Skipping build (--skip-build)`);
+	const dockerConfig = resolveDockerConfig$1(config$1);
+	const imageName = dockerConfig.imageName ?? "app";
+	const registry = dockerConfig.registry;
+	const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
+	let result;
+	switch (provider) {
+		case "docker": {
+			result = await deployDocker({
+				stage,
+				tag: imageTag,
+				skipPush,
+				masterKey,
+				config: dockerConfig
+			});
+			break;
+		}
+		case "dokploy": {
+			const dokployConfigRaw = config$1.providers?.dokploy;
+			if (typeof dokployConfigRaw === "boolean" || !dokployConfigRaw) throw new Error("Dokploy provider requires configuration.\nConfigure in gkm.config.ts:\n  providers: {\n    dokploy: {\n      endpoint: 'https://dokploy.example.com',\n      projectId: 'proj_xxx',\n      applicationId: 'app_xxx',\n    },\n  }");
+			validateDokployConfig(dokployConfigRaw);
+			const dokployConfig = dokployConfigRaw;
+			await deployDocker({
+				stage,
+				tag: imageTag,
+				skipPush: false,
+				masterKey,
+				config: {
+					registry: dokployConfig.registry ?? dockerConfig.registry,
+					imageName: dockerConfig.imageName
+				}
+			});
+			result = await deployDokploy({
+				stage,
+				tag: imageTag,
+				imageRef,
+				masterKey,
+				config: dokployConfig
+			});
+			break;
+		}
+		case "aws-lambda": {
+			logger$3.log("\n⚠️  AWS Lambda deployment is not yet implemented.");
+			logger$3.log("   Use SST or AWS CDK for Lambda deployments.");
+			result = {
+				imageRef,
+				masterKey
+			};
+			break;
+		}
+		default: throw new Error(`Unknown deploy provider: ${provider}\nSupported providers: docker, dokploy, aws-lambda`);
+	}
+	logger$3.log("\n✅ Deployment complete!");
+	return result;
+}
+
+//#endregion
+//#region src/deploy/init.ts
+const logger$2 = console;
+/**
+* Get the Dokploy API token from stored credentials or environment
+*/
+async function getApiToken() {
+	const token = await getDokployToken();
+	if (!token) throw new Error("Dokploy credentials not found.\nRun \"gkm login --service dokploy\" to authenticate, or set DOKPLOY_API_TOKEN.");
+	return token;
+}
+/**
+* Make a request to the Dokploy API
+*/
+async function dokployRequest(method, endpoint, baseUrl, token, body) {
+	const url = `${baseUrl}/api/${endpoint}`;
+	const response = await fetch(url, {
+		method,
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${token}`
+		},
+		body: body ? JSON.stringify(body) : void 0
+	});
+	if (!response.ok) {
+		let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
+		try {
+			const errorBody = await response.json();
+			if (errorBody.message) errorMessage = `Dokploy API error: ${errorBody.message}`;
+		} catch {}
+		throw new Error(errorMessage);
+	}
+	const text = await response.text();
+	if (!text) return {};
+	return JSON.parse(text);
+}
+/**
+* Get all projects from Dokploy
+*/
+async function getProjects(baseUrl, token) {
+	return dokployRequest("GET", "project.all", baseUrl, token);
+}
+/**
+* Create a new project in Dokploy
+*/
+async function createProject(baseUrl, token, name$1, description$1) {
+	return dokployRequest("POST", "project.create", baseUrl, token, {
+		name: name$1,
+		description: description$1 || `Created by gkm CLI`
+	});
+}
+/**
+* Get project by ID to get environment info
+*/
+async function getProject(baseUrl, token, projectId) {
+	return dokployRequest("POST", "project.one", baseUrl, token, { projectId });
+}
+/**
+* Create a new application in Dokploy
+*/
+async function createApplication(baseUrl, token, name$1, projectId) {
+	const project = await getProject(baseUrl, token, projectId);
+	let environmentId;
+	const firstEnv = project.environments?.[0];
+	if (firstEnv) environmentId = firstEnv.environmentId;
+	else {
+		const env = await dokployRequest("POST", "environment.create", baseUrl, token, {
+			projectId,
+			name: "production",
+			description: "Production environment"
+		});
+		environmentId = env.environmentId;
+	}
+	return dokployRequest("POST", "application.create", baseUrl, token, {
+		name: name$1,
+		projectId,
+		environmentId
+	});
+}
+/**
+* Configure application for Docker registry deployment
+*/
+async function configureApplicationRegistry(baseUrl, token, applicationId, registryId) {
+	await dokployRequest("POST", "application.update", baseUrl, token, {
+		applicationId,
+		registryId
+	});
+}
+/**
+* Get available registries
+*/
+async function getRegistries(baseUrl, token) {
+	return dokployRequest("GET", "registry.all", baseUrl, token);
+}
+/**
+* Update gkm.config.ts with Dokploy configuration
+*/
+async function updateConfig(config$1, cwd = process.cwd()) {
+	const configPath = join(cwd, "gkm.config.ts");
+	if (!existsSync(configPath)) {
+		logger$2.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
+		logger$2.log(`  providers: {`);
+		logger$2.log(`    dokploy: {`);
+		logger$2.log(`      endpoint: '${config$1.endpoint}',`);
+		logger$2.log(`      projectId: '${config$1.projectId}',`);
+		logger$2.log(`      applicationId: '${config$1.applicationId}',`);
+		logger$2.log(`    },`);
+		logger$2.log(`  },`);
 		return;
 	}
-	const rootOutputDir = join$1(process.cwd(), ".gkm");
-	await mkdir(rootOutputDir, { recursive: true });
-	for (const provider of resolved.providers) await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi);
+	const content = await readFile(configPath, "utf-8");
+	if (content.includes("dokploy:") && content.includes("applicationId:")) {
+		logger$2.log("\n  Dokploy config already exists in gkm.config.ts");
+		logger$2.log("  Updating with new values...");
+	}
+	let newContent;
+	if (content.includes("providers:")) if (content.includes("dokploy:")) newContent = content.replace(/dokploy:\s*\{[^}]*\}/, `dokploy: {
+			endpoint: '${config$1.endpoint}',
+			projectId: '${config$1.projectId}',
+			applicationId: '${config$1.applicationId}',
+		}`);
+	else newContent = content.replace(/providers:\s*\{/, `providers: {
+		dokploy: {
+			endpoint: '${config$1.endpoint}',
+			projectId: '${config$1.projectId}',
+			applicationId: '${config$1.applicationId}',
+		},`);
+	else newContent = content.replace(/}\s*\)\s*;?\s*$/, `
+	providers: {
+		dokploy: {
+			endpoint: '${config$1.endpoint}',
+			projectId: '${config$1.projectId}',
+			applicationId: '${config$1.applicationId}',
+		},
+	},
+});`);
+	await writeFile(configPath, newContent);
+	logger$2.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
+}
+/**
+* Initialize Dokploy deployment configuration
+*/
+async function deployInitCommand(options) {
+	const { projectName, appName, projectId: existingProjectId, registryId } = options;
+	let endpoint = options.endpoint;
+	if (!endpoint) {
+		const stored = await getDokployCredentials();
+		if (stored) endpoint = stored.endpoint;
+		else throw new Error("Dokploy endpoint not specified.\nEither run \"gkm login --service dokploy\" first, or provide --endpoint.");
+	}
+	logger$2.log(`\n🚀 Initializing Dokploy deployment...`);
+	logger$2.log(`   Endpoint: ${endpoint}`);
+	const token = await getApiToken();
+	let projectId;
+	if (existingProjectId) {
+		projectId = existingProjectId;
+		logger$2.log(`\n📁 Using existing project: ${projectId}`);
+	} else {
+		logger$2.log(`\n📁 Looking for project: ${projectName}`);
+		const projects = await getProjects(endpoint, token);
+		const existingProject = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
+		if (existingProject) {
+			projectId = existingProject.projectId;
+			logger$2.log(`   Found existing project: ${projectId}`);
+		} else {
+			logger$2.log(`   Creating new project...`);
+			const project = await createProject(endpoint, token, projectName);
+			projectId = project.projectId;
+			logger$2.log(`   ✓ Created project: ${projectId}`);
+		}
+	}
+	logger$2.log(`\n📦 Creating application: ${appName}`);
+	const application = await createApplication(endpoint, token, appName, projectId);
+	logger$2.log(`   ✓ Created application: ${application.applicationId}`);
+	if (registryId) {
+		logger$2.log(`\n🔧 Configuring registry: ${registryId}`);
+		await configureApplicationRegistry(endpoint, token, application.applicationId, registryId);
+		logger$2.log(`   ✓ Registry configured`);
+	} else try {
+		const registries = await getRegistries(endpoint, token);
+		if (registries.length > 0) {
+			logger$2.log(`\n📋 Available registries:`);
+			for (const reg of registries) logger$2.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
+			logger$2.log(`\n   To use a registry, run with --registry-id <id>`);
+		}
+	} catch {}
+	const config$1 = {
+		endpoint,
+		projectId,
+		applicationId: application.applicationId
+	};
+	await updateConfig(config$1);
+	logger$2.log(`\n✅ Dokploy deployment initialized!`);
+	logger$2.log(`\n📋 Configuration:`);
+	logger$2.log(`   Project ID: ${projectId}`);
+	logger$2.log(`   Application ID: ${application.applicationId}`);
+	logger$2.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
+	logger$2.log(`\n📝 Next steps:`);
+	logger$2.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
+	logger$2.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
+	return config$1;
+}
+/**
+* List available Dokploy resources
+*/
+async function deployListCommand(options) {
+	let endpoint = options.endpoint;
+	if (!endpoint) {
+		const stored = await getDokployCredentials();
+		if (stored) endpoint = stored.endpoint;
+		else throw new Error("Dokploy endpoint not specified.\nEither run \"gkm login --service dokploy\" first, or provide --endpoint.");
+	}
+	const { resource } = options;
+	const token = await getApiToken();
+	if (resource === "projects") {
+		logger$2.log(`\n📁 Projects in ${endpoint}:`);
+		const projects = await getProjects(endpoint, token);
+		if (projects.length === 0) {
+			logger$2.log("   No projects found");
+			return;
+		}
+		for (const project of projects) {
+			logger$2.log(`\n   ${project.name} (${project.projectId})`);
+			if (project.description) logger$2.log(`     ${project.description}`);
+		}
+	} else if (resource === "registries") {
+		logger$2.log(`\n🐳 Registries in ${endpoint}:`);
+		const registries = await getRegistries(endpoint, token);
+		if (registries.length === 0) {
+			logger$2.log("   No registries configured");
+			logger$2.log("   Add a registry in Dokploy: Settings > Docker Registry");
+			return;
+		}
+		for (const registry of registries) {
+			logger$2.log(`\n   ${registry.registryName} (${registry.registryId})`);
+			logger$2.log(`     URL: ${registry.registryUrl}`);
+			logger$2.log(`     Username: ${registry.username}`);
+			if (registry.imagePrefix) logger$2.log(`     Prefix: ${registry.imagePrefix}`);
+		}
+	}
+}
+
+//#endregion
+//#region src/docker/compose.ts
+/** Default Docker images for services */
+const DEFAULT_SERVICE_IMAGES = {
+	postgres: "postgres",
+	redis: "redis",
+	rabbitmq: "rabbitmq"
+};
+/** Default Docker image versions for services */
+const DEFAULT_SERVICE_VERSIONS = {
+	postgres: "16-alpine",
+	redis: "7-alpine",
+	rabbitmq: "3-management-alpine"
+};
+/** Get the default full image reference for a service */
+function getDefaultImage(serviceName) {
+	return `${DEFAULT_SERVICE_IMAGES[serviceName]}:${DEFAULT_SERVICE_VERSIONS[serviceName]}`;
+}
+/** Normalize services config to a consistent format - returns Map of service name to full image reference */
+function normalizeServices(services) {
+	const result = /* @__PURE__ */ new Map();
+	if (Array.isArray(services)) for (const name$1 of services) result.set(name$1, getDefaultImage(name$1));
+	else for (const [name$1, config$1] of Object.entries(services)) {
+		const serviceName = name$1;
+		if (config$1 === true) result.set(serviceName, getDefaultImage(serviceName));
+		else if (config$1 && typeof config$1 === "object") {
+			const serviceConfig = config$1;
+			if (serviceConfig.image) result.set(serviceName, serviceConfig.image);
+			else {
+				const version$1 = serviceConfig.version ?? DEFAULT_SERVICE_VERSIONS[serviceName];
+				result.set(serviceName, `${DEFAULT_SERVICE_IMAGES[serviceName]}:${version$1}`);
+			}
+		}
+	}
+	return result;
+}
+/**
+* Generate docker-compose.yml for production deployment
+*/
+function generateDockerCompose(options) {
+	const { imageName, registry, port, healthCheckPath, services } = options;
+	const serviceMap = normalizeServices(services);
+	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
+	let yaml = `version: '3.8'
+
+services:
+  api:
+    build:
+      context: ../..
+      dockerfile: .gkm/docker/Dockerfile
+    image: ${imageRef}\${IMAGE_NAME:-${imageName}}:\${TAG:-latest}
+    container_name: ${imageName}
+    restart: unless-stopped
+    ports:
+      - "\${PORT:-${port}}:${port}"
+    environment:
+      - NODE_ENV=production
+`;
+	if (serviceMap.has("postgres")) yaml += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/app}
+`;
+	if (serviceMap.has("redis")) yaml += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
+`;
+	if (serviceMap.has("rabbitmq")) yaml += `      - RABBITMQ_URL=\${RABBITMQ_URL:-amqp://rabbitmq:5672}
+`;
+	yaml += `    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:${port}${healthCheckPath}"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+`;
+	if (serviceMap.size > 0) {
+		yaml += `    depends_on:
+`;
+		for (const serviceName of serviceMap.keys()) yaml += `      ${serviceName}:
+        condition: service_healthy
+`;
+	}
+	yaml += `    networks:
+      - app-network
+`;
+	const postgresImage = serviceMap.get("postgres");
+	if (postgresImage) yaml += `
+  postgres:
+    image: ${postgresImage}
+    container_name: postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: \${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: \${POSTGRES_DB:-app}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - app-network
+`;
+	const redisImage = serviceMap.get("redis");
+	if (redisImage) yaml += `
+  redis:
+    image: ${redisImage}
+    container_name: redis
+    restart: unless-stopped
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - app-network
+`;
+	const rabbitmqImage = serviceMap.get("rabbitmq");
+	if (rabbitmqImage) yaml += `
+  rabbitmq:
+    image: ${rabbitmqImage}
+    container_name: rabbitmq
+    restart: unless-stopped
+    environment:
+      RABBITMQ_DEFAULT_USER: \${RABBITMQ_USER:-guest}
+      RABBITMQ_DEFAULT_PASS: \${RABBITMQ_PASSWORD:-guest}
+    ports:
+      - "15672:15672"  # Management UI
+    volumes:
+      - rabbitmq_data:/var/lib/rabbitmq
+    healthcheck:
+      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - app-network
+`;
+	yaml += `
+volumes:
+`;
+	if (serviceMap.has("postgres")) yaml += `  postgres_data:
+`;
+	if (serviceMap.has("redis")) yaml += `  redis_data:
+`;
+	if (serviceMap.has("rabbitmq")) yaml += `  rabbitmq_data:
+`;
+	yaml += `
+networks:
+  app-network:
+    driver: bridge
+`;
+	return yaml;
+}
+/**
+* Generate a minimal docker-compose.yml for API only
+*/
+function generateMinimalDockerCompose(options) {
+	const { imageName, registry, port, healthCheckPath } = options;
+	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
+	return `version: '3.8'
+
+services:
+  api:
+    build:
+      context: ../..
+      dockerfile: .gkm/docker/Dockerfile
+    image: ${imageRef}\${IMAGE_NAME:-${imageName}}:\${TAG:-latest}
+    container_name: ${imageName}
+    restart: unless-stopped
+    ports:
+      - "\${PORT:-${port}}:${port}"
+    environment:
+      - NODE_ENV=production
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:${port}${healthCheckPath}"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+    networks:
+      - app-network
+
+networks:
+  app-network:
+    driver: bridge
+`;
+}
+
+//#endregion
+//#region src/docker/templates.ts
+/**
+* Detect package manager from lockfiles
+* Walks up the directory tree to find lockfile (for monorepos)
+*/
+function detectPackageManager$1(cwd = process.cwd()) {
+	const lockfiles = [
+		["pnpm-lock.yaml", "pnpm"],
+		["bun.lockb", "bun"],
+		["yarn.lock", "yarn"],
+		["package-lock.json", "npm"]
+	];
+	let dir = cwd;
+	const root = parse(dir).root;
+	while (dir !== root) {
+		for (const [lockfile, pm] of lockfiles) if (existsSync(join(dir, lockfile))) return pm;
+		dir = dirname(dir);
+	}
+	for (const [lockfile, pm] of lockfiles) if (existsSync(join(root, lockfile))) return pm;
+	return "pnpm";
+}
+/**
+* Get package manager specific commands and paths
+*/
+function getPmConfig(pm) {
+	const configs = {
+		pnpm: {
+			install: "corepack enable && corepack prepare pnpm@latest --activate",
+			lockfile: "pnpm-lock.yaml",
+			fetch: "pnpm fetch",
+			installCmd: "pnpm install --frozen-lockfile --offline",
+			cacheTarget: "/root/.local/share/pnpm/store",
+			cacheId: "pnpm",
+			run: "pnpm",
+			addGlobal: "pnpm add -g"
+		},
+		npm: {
+			install: "",
+			lockfile: "package-lock.json",
+			fetch: "",
+			installCmd: "npm ci",
+			cacheTarget: "/root/.npm",
+			cacheId: "npm",
+			run: "npm run",
+			addGlobal: "npm install -g"
+		},
+		yarn: {
+			install: "corepack enable && corepack prepare yarn@stable --activate",
+			lockfile: "yarn.lock",
+			fetch: "",
+			installCmd: "yarn install --frozen-lockfile",
+			cacheTarget: "/root/.yarn/cache",
+			cacheId: "yarn",
+			run: "yarn",
+			addGlobal: "yarn global add"
+		},
+		bun: {
+			install: "npm install -g bun",
+			lockfile: "bun.lockb",
+			fetch: "",
+			installCmd: "bun install --frozen-lockfile",
+			cacheTarget: "/root/.bun/install/cache",
+			cacheId: "bun",
+			run: "bun run",
+			addGlobal: "bun add -g"
+		}
+	};
+	return configs[pm];
+}
+/**
+* Generate a multi-stage Dockerfile for building from source
+* Optimized for build speed with:
+* - BuildKit cache mounts for package manager store
+* - pnpm fetch for better layer caching (when using pnpm)
+* - Optional turbo prune for monorepos
+*/
+function generateMultiStageDockerfile(options) {
+	const { baseImage, port, healthCheckPath, turbo, turboPackage, packageManager } = options;
+	if (turbo) return generateTurboDockerfile({
+		...options,
+		turboPackage: turboPackage ?? "api"
+	});
+	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `\n# Install ${packageManager}\nRUN ${pm.install}\n` : "";
+	const hasFetch = packageManager === "pnpm";
+	const depsStage = hasFetch ? `# Copy lockfile first for better caching
+COPY ${pm.lockfile} ./
+
+# Fetch dependencies (downloads to virtual store, cached separately)
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.fetch}
+
+# Copy package.json after fetch
+COPY package.json ./
+
+# Install from cache (fast - no network needed)
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}` : `# Copy package files
+COPY package.json ${pm.lockfile} ./
+
+# Install dependencies with cache
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}`;
+	return `# syntax=docker/dockerfile:1
+# Stage 1: Dependencies
+FROM ${baseImage} AS deps
+
+WORKDIR /app
+${installPm}
+${depsStage}
+
+# Stage 2: Build
+FROM deps AS builder
+
+WORKDIR /app
+
+# Copy source (deps already installed)
+COPY . .
+
+# Build production server
+RUN ${pm.run} gkm build --provider server --production
+
+# Stage 3: Production
+FROM ${baseImage} AS runner
+
+WORKDIR /app
+
+# Install tini for proper signal handling as PID 1
+RUN apk add --no-cache tini
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+# Copy bundled server
+COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
+
+# Environment
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\
+  CMD wget -q --spider http://localhost:${port}${healthCheckPath} || exit 1
+
+# Switch to non-root user
+USER hono
+
+EXPOSE ${port}
+
+# Use tini as entrypoint to handle PID 1 responsibilities
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
+}
+/**
+* Generate a Dockerfile optimized for Turbo monorepos
+* Uses turbo prune to create minimal Docker context
+*/
+function generateTurboDockerfile(options) {
+	const { baseImage, port, healthCheckPath, turboPackage, packageManager } = options;
+	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `RUN ${pm.install}` : "";
+	const hasFetch = packageManager === "pnpm";
+	const depsInstall = hasFetch ? `# Fetch and install from cache
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.fetch}
+
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}` : `# Install dependencies with cache
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}`;
+	return `# syntax=docker/dockerfile:1
+# Stage 1: Prune monorepo
+FROM ${baseImage} AS pruner
+
+WORKDIR /app
+
+${installPm}
+RUN ${pm.addGlobal} turbo
+
+COPY . .
+
+# Prune to only include necessary packages
+RUN turbo prune ${turboPackage} --docker
+
+# Stage 2: Install dependencies
+FROM ${baseImage} AS deps
+
+WORKDIR /app
+
+${installPm}
+
+# Copy pruned lockfile and package.jsons
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+
+${depsInstall}
+
+# Stage 3: Build
+FROM deps AS builder
+
+WORKDIR /app
+
+# Copy pruned source
+COPY --from=pruner /app/out/full/ ./
+
+# Build production server
+RUN ${pm.run} gkm build --provider server --production
+
+# Stage 4: Production
+FROM ${baseImage} AS runner
+
+WORKDIR /app
+
+RUN apk add --no-cache tini
+
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\
+  CMD wget -q --spider http://localhost:${port}${healthCheckPath} || exit 1
+
+USER hono
+
+EXPOSE ${port}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
+}
+/**
+* Generate a slim Dockerfile for pre-built bundles
+*/
+function generateSlimDockerfile(options) {
+	const { baseImage, port, healthCheckPath } = options;
+	return `# Slim Dockerfile for pre-built production bundle
+FROM ${baseImage}
+
+WORKDIR /app
+
+# Install tini for proper signal handling as PID 1
+# Handles SIGTERM propagation and zombie process reaping
+RUN apk add --no-cache tini
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+# Copy pre-built bundle
+COPY .gkm/server/dist/server.mjs ./
+
+# Environment
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\
+  CMD wget -q --spider http://localhost:${port}${healthCheckPath} || exit 1
+
+# Switch to non-root user
+USER hono
+
+EXPOSE ${port}
+
+# Use tini as entrypoint to handle PID 1 responsibilities
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
+}
+/**
+* Generate .dockerignore file
+*/
+function generateDockerignore() {
+	return `# Dependencies
+node_modules
+.pnpm-store
+
+# Build output (except what we need)
+.gkm/aws*
+.gkm/server/*.ts
+!.gkm/server/dist
+
+# IDE and editor
+.idea
+.vscode
+*.swp
+*.swo
+
+# Git
+.git
+.gitignore
+
+# Logs
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Test files
+**/*.test.ts
+**/*.spec.ts
+**/__tests__
+coverage
+
+# Documentation
+docs
+*.md
+!README.md
+
+# Environment files (handle secrets separately)
+.env
+.env.*
+!.env.example
+
+# Docker files (don't copy recursively)
+Dockerfile*
+docker-compose*
+.dockerignore
+`;
+}
+/**
+* Generate docker-entrypoint.sh for custom startup logic
+*/
+function generateDockerEntrypoint() {
+	return `#!/bin/sh
+set -e
+
+# Run any custom startup scripts here
+# Example: wait for database
+# until nc -z $DB_HOST $DB_PORT; do
+#   echo "Waiting for database..."
+#   sleep 1
+# done
+
+# Execute the main command
+exec "$@"
+`;
+}
+/**
+* Resolve Docker configuration from GkmConfig with defaults
+*/
+function resolveDockerConfig(config$1) {
+	const docker = config$1.docker ?? {};
+	let defaultImageName = "api";
+	try {
+		const pkg = __require(`${process.cwd()}/package.json`);
+		if (pkg.name) defaultImageName = pkg.name.replace(/^@[^/]+\//, "");
+	} catch {}
+	return {
+		registry: docker.registry ?? "",
+		imageName: docker.imageName ?? defaultImageName,
+		baseImage: docker.baseImage ?? "node:22-alpine",
+		port: docker.port ?? 3e3,
+		compose: docker.compose
+	};
+}
+
+//#endregion
+//#region src/docker/index.ts
+const logger$1 = console;
+/**
+* Docker command implementation
+* Generates Dockerfile, docker-compose.yml, and related files
+*
+* Default: Multi-stage Dockerfile that builds from source inside Docker
+* --slim: Slim Dockerfile that copies pre-built bundle (requires prior build)
+*/
+async function dockerCommand(options) {
+	const config$1 = await loadConfig();
+	const dockerConfig = resolveDockerConfig(config$1);
+	const serverConfig = typeof config$1.providers?.server === "object" ? config$1.providers.server : void 0;
+	const healthCheckPath = serverConfig?.production?.healthCheck ?? "/health";
+	const useSlim = options.slim === true;
+	if (useSlim) {
+		const distDir = join(process.cwd(), ".gkm", "server", "dist");
+		const hasBuild = existsSync(join(distDir, "server.mjs"));
+		if (!hasBuild) throw new Error("Slim Dockerfile requires a pre-built bundle. Run `gkm build --provider server --production` first, or omit --slim to use multi-stage build.");
+	}
+	const dockerDir = join(process.cwd(), ".gkm", "docker");
+	await mkdir(dockerDir, { recursive: true });
+	const packageManager = detectPackageManager$1();
+	const templateOptions = {
+		imageName: dockerConfig.imageName,
+		baseImage: dockerConfig.baseImage,
+		port: dockerConfig.port,
+		healthCheckPath,
+		prebuilt: useSlim,
+		turbo: options.turbo,
+		turboPackage: options.turboPackage ?? dockerConfig.imageName,
+		packageManager
+	};
+	const dockerfile = useSlim ? generateSlimDockerfile(templateOptions) : generateMultiStageDockerfile(templateOptions);
+	const dockerMode = useSlim ? "slim" : options.turbo ? "turbo" : "multi-stage";
+	const dockerfilePath = join(dockerDir, "Dockerfile");
+	await writeFile(dockerfilePath, dockerfile);
+	logger$1.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
+	const composeOptions = {
+		imageName: dockerConfig.imageName,
+		registry: options.registry ?? dockerConfig.registry,
+		port: dockerConfig.port,
+		healthCheckPath,
+		services: dockerConfig.compose?.services ?? {}
+	};
+	const hasServices = Array.isArray(composeOptions.services) ? composeOptions.services.length > 0 : Object.keys(composeOptions.services).length > 0;
+	const dockerCompose = hasServices ? generateDockerCompose(composeOptions) : generateMinimalDockerCompose(composeOptions);
+	const composePath = join(dockerDir, "docker-compose.yml");
+	await writeFile(composePath, dockerCompose);
+	logger$1.log("Generated: .gkm/docker/docker-compose.yml");
+	const dockerignore = generateDockerignore();
+	const dockerignorePath = join(process.cwd(), ".dockerignore");
+	await writeFile(dockerignorePath, dockerignore);
+	logger$1.log("Generated: .dockerignore (project root)");
+	const entrypoint = generateDockerEntrypoint();
+	const entrypointPath = join(dockerDir, "docker-entrypoint.sh");
+	await writeFile(entrypointPath, entrypoint);
+	logger$1.log("Generated: .gkm/docker/docker-entrypoint.sh");
+	const result = {
+		dockerfile: dockerfilePath,
+		dockerCompose: composePath,
+		dockerignore: dockerignorePath,
+		entrypoint: entrypointPath
+	};
+	if (options.build) await buildDockerImage(dockerConfig.imageName, options);
+	if (options.push) await pushDockerImage(dockerConfig.imageName, options);
+	return result;
+}
+/**
+* Build Docker image
+* Uses BuildKit for cache mount support
+*/
+async function buildDockerImage(imageName, options) {
+	const tag = options.tag ?? "latest";
+	const registry = options.registry;
+	const fullImageName = registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
+	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	try {
+		execSync(`DOCKER_BUILDKIT=1 docker build -f .gkm/docker/Dockerfile -t ${fullImageName} .`, {
+			cwd: process.cwd(),
+			stdio: "inherit",
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			}
+		});
+		logger$1.log(`✅ Docker image built: ${fullImageName}`);
+	} catch (error) {
+		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi) {
-	const outputDir = join$1(process.cwd(), ".gkm", provider);
-	await mkdir(outputDir, { recursive: true });
-	logger.log(`\nGenerating handlers for provider: ${provider}`);
-	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
-		endpointGenerator.build(context, endpoints, outputDir, {
-			provider,
-			enableOpenApi
-		}),
-		functionGenerator.build(context, functions, outputDir, { provider }),
-		cronGenerator.build(context, crons, outputDir, { provider }),
-		subscriberGenerator.build(context, subscribers, outputDir, { provider })
-	]);
-	logger.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
-	if (provider === "server") {
-		const routeMetadata = await Promise.all(endpoints.map(async ({ construct }) => ({
-			path: construct._path,
-			method: construct.method,
-			handler: "",
-			authorizer: construct.authorizer?.name ?? "none"
-		})));
-		const appInfo = {
-			handler: relative$1(process.cwd(), join$1(outputDir, "app.ts")),
-			endpoints: relative$1(process.cwd(), join$1(outputDir, "endpoints.ts"))
-		};
-		await generateServerManifest(rootOutputDir, appInfo, routeMetadata, subscriberInfos);
-	} else await generateAwsManifest(rootOutputDir, routes, functionInfos, cronInfos, subscriberInfos);
+/**
+* Push Docker image to registry
+*/
+async function pushDockerImage(imageName, options) {
+	const tag = options.tag ?? "latest";
+	const registry = options.registry;
+	if (!registry) throw new Error("Registry is required to push Docker image. Use --registry or configure docker.registry in gkm.config.ts");
+	const fullImageName = `${registry}/${imageName}:${tag}`;
+	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	try {
+		execSync(`docker push ${fullImageName}`, {
+			cwd: process.cwd(),
+			stdio: "inherit"
+		});
+		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
+	} catch (error) {
+		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
 }
 
 //#endregion
@@ -1064,7 +2534,7 @@ export default defineConfig({
 		content: gkmConfig
 	}, {
 		path: "tsconfig.json",
-		content: JSON.stringify(tsConfig, null, 2) + "\n"
+		content: `${JSON.stringify(tsConfig, null, 2)}\n`
 	}];
 	const biomeConfig = {
 		$schema: "https://biomejs.dev/schemas/1.9.4/schema.json",
@@ -1138,15 +2608,15 @@ export default defineConfig({
 		},
 		{
 			path: "tsconfig.json",
-			content: JSON.stringify(tsConfig, null, 2) + "\n"
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
 		},
 		{
 			path: "biome.json",
-			content: JSON.stringify(biomeConfig, null, 2) + "\n"
+			content: `${JSON.stringify(biomeConfig, null, 2)}\n`
 		},
 		{
 			path: "turbo.json",
-			content: JSON.stringify(turboConfig, null, 2) + "\n"
+			content: `${JSON.stringify(turboConfig, null, 2)}\n`
 		}
 	];
 }
@@ -1498,11 +2968,11 @@ export type UpdateUser = z.infer<typeof updateUserSchema>;
 	return [
 		{
 			path: "packages/models/package.json",
-			content: JSON.stringify(packageJson, null, 2) + "\n"
+			content: `${JSON.stringify(packageJson, null, 2)}\n`
 		},
 		{
 			path: "packages/models/tsconfig.json",
-			content: JSON.stringify(tsConfig, null, 2) + "\n"
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
 		},
 		{
 			path: "packages/models/src/index.ts",
@@ -1668,7 +3138,7 @@ coverage/
 	return [
 		{
 			path: "package.json",
-			content: JSON.stringify(rootPackageJson, null, 2) + "\n"
+			content: `${JSON.stringify(rootPackageJson, null, 2)}\n`
 		},
 		{
 			path: "pnpm-workspace.yaml",
@@ -1676,15 +3146,15 @@ coverage/
 		},
 		{
 			path: "tsconfig.json",
-			content: JSON.stringify(tsConfig, null, 2) + "\n"
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
 		},
 		{
 			path: "biome.json",
-			content: JSON.stringify(biomeConfig, null, 2) + "\n"
+			content: `${JSON.stringify(biomeConfig, null, 2)}\n`
 		},
 		{
 			path: "turbo.json",
-			content: JSON.stringify(turboConfig, null, 2) + "\n"
+			content: `${JSON.stringify(turboConfig, null, 2)}\n`
 		},
 		{
 			path: ".gitignore",
@@ -2405,19 +3875,19 @@ function generatePackageJson(options, template) {
 	if (studio) dependencies$1["@geekmidas/studio"] = "workspace:*";
 	if (database) {
 		dependencies$1["@geekmidas/db"] = "workspace:*";
-		dependencies$1["kysely"] = "~0.28.2";
-		dependencies$1["pg"] = "~8.16.0";
+		dependencies$1.kysely = "~0.28.2";
+		dependencies$1.pg = "~8.16.0";
 		devDependencies$1["@types/pg"] = "~8.15.0";
 	}
-	dependencies$1["zod"] = "~4.1.0";
+	dependencies$1.zod = "~4.1.0";
 	if (monorepo) {
 		delete devDependencies$1["@biomejs/biome"];
-		delete devDependencies$1["turbo"];
-		delete scripts$1["lint"];
-		delete scripts$1["fmt"];
+		delete devDependencies$1.turbo;
+		delete scripts$1.lint;
+		delete scripts$1.fmt;
 		delete scripts$1["fmt:check"];
 		dependencies$1[`@${name$1}/models`] = "workspace:*";
-		delete dependencies$1["zod"];
+		delete dependencies$1.zod;
 	}
 	const sortObject = (obj) => Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));
 	let packageName = name$1;
@@ -2441,7 +3911,7 @@ function generatePackageJson(options, template) {
 	};
 	return [{
 		path: "package.json",
-		content: JSON.stringify(packageJson, null, 2) + "\n"
+		content: `${JSON.stringify(packageJson, null, 2)}\n`
 	}];
 }
 
@@ -2460,10 +3930,10 @@ function generateSourceFiles(options, template) {
 * Detect the package manager being used based on lockfiles or npm_config_user_agent
 */
 function detectPackageManager(cwd = process.cwd()) {
-	if (existsSync(join$1(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if (existsSync(join$1(cwd, "yarn.lock"))) return "yarn";
-	if (existsSync(join$1(cwd, "bun.lockb"))) return "bun";
-	if (existsSync(join$1(cwd, "package-lock.json"))) return "npm";
+	if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+	if (existsSync(join(cwd, "yarn.lock"))) return "yarn";
+	if (existsSync(join(cwd, "bun.lockb"))) return "bun";
+	if (existsSync(join(cwd, "package-lock.json"))) return "npm";
 	const userAgent = process.env.npm_config_user_agent || "";
 	if (userAgent.includes("pnpm")) return "pnpm";
 	if (userAgent.includes("yarn")) return "yarn";
@@ -2489,7 +3959,7 @@ function validateProjectName(name$1) {
 * Check if a directory already exists at the target path
 */
 function checkDirectoryExists(name$1, cwd = process.cwd()) {
-	const targetPath = join$1(cwd, name$1);
+	const targetPath = join(cwd, name$1);
 	if (existsSync(targetPath)) return `Directory "${name$1}" already exists`;
 	return true;
 }
@@ -2501,7 +3971,6 @@ function getInstallCommand(pkgManager) {
 		case "pnpm": return "pnpm install";
 		case "yarn": return "yarn";
 		case "bun": return "bun install";
-		case "npm":
 		default: return "npm install";
 	}
 }
@@ -2513,7 +3982,6 @@ function getRunCommand(pkgManager, script) {
 		case "pnpm": return `pnpm ${script}`;
 		case "yarn": return `yarn ${script}`;
 		case "bun": return `bun run ${script}`;
-		case "npm":
 		default: return `npm run ${script}`;
 	}
 }
@@ -2597,21 +4065,12 @@ async function initCommand(projectName, options = {}) {
 		}
 	], { onCancel });
 	const name$1 = projectName || answers.name;
-	if (!name$1) {
-		console.error("  Error: Project name is required\n");
-		process.exit(1);
-	}
+	if (!name$1) process.exit(1);
 	if (projectName) {
 		const nameValid = validateProjectName(projectName);
-		if (nameValid !== true) {
-			console.error(`  Error: ${nameValid}\n`);
-			process.exit(1);
-		}
+		if (nameValid !== true) process.exit(1);
 		const dirValid = checkDirectoryExists(projectName, cwd);
-		if (dirValid !== true) {
-			console.error(`  Error: ${dirValid}\n`);
-			process.exit(1);
-		}
+		if (dirValid !== true) process.exit(1);
 	}
 	const monorepo = options.monorepo ?? (options.yes ? false : answers.monorepo ?? false);
 	const database = options.yes ? true : answers.database ?? true;
@@ -2626,12 +4085,12 @@ async function initCommand(projectName, options = {}) {
 		monorepo,
 		apiPath: monorepo ? options.apiPath ?? answers.apiPath ?? "apps/api" : ""
 	};
-	const targetDir = join$1(cwd, name$1);
+	const targetDir = join(cwd, name$1);
 	const template = getTemplate(templateOptions.template);
 	const isMonorepo = templateOptions.monorepo;
 	const apiPath = templateOptions.apiPath;
 	await mkdir(targetDir, { recursive: true });
-	const appDir = isMonorepo ? join$1(targetDir, apiPath) : targetDir;
+	const appDir = isMonorepo ? join(targetDir, apiPath) : targetDir;
 	if (isMonorepo) await mkdir(appDir, { recursive: true });
 	const appFiles = [
 		...generatePackageJson(templateOptions, template),
@@ -2642,13 +4101,13 @@ async function initCommand(projectName, options = {}) {
 	];
 	const rootFiles = [...generateMonorepoFiles(templateOptions, template), ...generateModelsPackage(templateOptions)];
 	for (const { path, content } of rootFiles) {
-		const fullPath = join$1(targetDir, path);
+		const fullPath = join(targetDir, path);
 		await mkdir(dirname(fullPath), { recursive: true });
 		await writeFile(fullPath, content);
 	}
 	for (const { path, content } of appFiles) {
-		const fullPath = join$1(appDir, path);
-		const displayPath = isMonorepo ? `${apiPath}/${path}` : path;
+		const fullPath = join(appDir, path);
+		const _displayPath = isMonorepo ? `${apiPath}/${path}` : path;
 		await mkdir(dirname(fullPath), { recursive: true });
 		await writeFile(fullPath, content);
 	}
@@ -2658,9 +4117,7 @@ async function initCommand(projectName, options = {}) {
 				cwd: targetDir,
 				stdio: "inherit"
 			});
-		} catch {
-			console.error("\n  Warning: Failed to install dependencies.");
-		}
+		} catch {}
 		try {
 			execSync("npx @biomejs/biome format --write --unsafe .", {
 				cwd: targetDir,
@@ -2668,7 +4125,310 @@ async function initCommand(projectName, options = {}) {
 			});
 		} catch {}
 	}
-	const devCommand$1 = getRunCommand(pkgManager, "dev");
+	const _devCommand = getRunCommand(pkgManager, "dev");
+}
+
+//#endregion
+//#region src/secrets/generator.ts
+/**
+* Generate a secure random password using URL-safe base64 characters.
+* @param length Password length (default: 32)
+*/
+function generateSecurePassword(length = 32) {
+	return randomBytes(Math.ceil(length * 3 / 4)).toString("base64url").slice(0, length);
+}
+/** Default service configurations */
+const SERVICE_DEFAULTS = {
+	postgres: {
+		host: "postgres",
+		port: 5432,
+		username: "app",
+		database: "app"
+	},
+	redis: {
+		host: "redis",
+		port: 6379,
+		username: "default"
+	},
+	rabbitmq: {
+		host: "rabbitmq",
+		port: 5672,
+		username: "app",
+		vhost: "/"
+	}
+};
+/**
+* Generate credentials for a specific service.
+*/
+function generateServiceCredentials(service) {
+	const defaults = SERVICE_DEFAULTS[service];
+	return {
+		...defaults,
+		password: generateSecurePassword()
+	};
+}
+/**
+* Generate credentials for multiple services.
+*/
+function generateServicesCredentials(services) {
+	const result = {};
+	for (const service of services) result[service] = generateServiceCredentials(service);
+	return result;
+}
+/**
+* Generate connection URL for PostgreSQL.
+*/
+function generatePostgresUrl(creds) {
+	const { username, password, host, port, database } = creds;
+	return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
+}
+/**
+* Generate connection URL for Redis.
+*/
+function generateRedisUrl(creds) {
+	const { password, host, port } = creds;
+	return `redis://:${encodeURIComponent(password)}@${host}:${port}`;
+}
+/**
+* Generate connection URL for RabbitMQ.
+*/
+function generateRabbitmqUrl(creds) {
+	const { username, password, host, port, vhost } = creds;
+	const encodedVhost = encodeURIComponent(vhost ?? "/");
+	return `amqp://${username}:${encodeURIComponent(password)}@${host}:${port}/${encodedVhost}`;
+}
+/**
+* Generate connection URLs from service credentials.
+*/
+function generateConnectionUrls(services) {
+	const urls = {};
+	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
+	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
+	if (services.rabbitmq) urls.RABBITMQ_URL = generateRabbitmqUrl(services.rabbitmq);
+	return urls;
+}
+/**
+* Create a new StageSecrets object with generated credentials.
+*/
+function createStageSecrets(stage, services) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const serviceCredentials = generateServicesCredentials(services);
+	const urls = generateConnectionUrls(serviceCredentials);
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: serviceCredentials,
+		urls,
+		custom: {}
+	};
+}
+/**
+* Rotate password for a specific service.
+*/
+function rotateServicePassword(secrets, service) {
+	const currentCreds = secrets.services[service];
+	if (!currentCreds) throw new Error(`Service "${service}" not configured in secrets`);
+	const newCreds = {
+		...currentCreds,
+		password: generateSecurePassword()
+	};
+	const newServices = {
+		...secrets.services,
+		[service]: newCreds
+	};
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		services: newServices,
+		urls: generateConnectionUrls(newServices)
+	};
+}
+
+//#endregion
+//#region src/secrets/index.ts
+const logger = console;
+/**
+* Extract service names from compose config.
+*/
+function getServicesFromConfig(services) {
+	if (!services) return [];
+	if (Array.isArray(services)) return services;
+	return Object.entries(services).filter(([, config$1]) => config$1).map(([name$1]) => name$1);
+}
+/**
+* Initialize secrets for a stage.
+* Generates secure random passwords for configured services.
+*/
+async function secretsInitCommand(options) {
+	const { stage, force } = options;
+	if (!force && secretsExist(stage)) {
+		logger.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
+		process.exit(1);
+	}
+	const config$1 = await loadConfig();
+	const services = getServicesFromConfig(config$1.docker?.compose?.services);
+	if (services.length === 0) logger.warn("No services configured in docker.compose.services. Creating secrets with empty services.");
+	const secrets = createStageSecrets(stage, services);
+	await writeStageSecrets(secrets);
+	logger.log(`\n✓ Secrets initialized for stage "${stage}"`);
+	logger.log(`  Location: .gkm/secrets/${stage}.json`);
+	logger.log("\n  Generated credentials for:");
+	for (const service of services) logger.log(`    - ${service}`);
+	if (secrets.urls.DATABASE_URL) logger.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.RABBITMQ_URL) logger.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
+	logger.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
+	logger.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
+}
+/**
+* Read all data from stdin.
+*/
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf-8").trim();
+}
+/**
+* Set a custom secret.
+* If value is not provided, reads from stdin.
+*/
+async function secretsSetCommand(key, value, options) {
+	const { stage } = options;
+	let secretValue = value;
+	if (!secretValue) {
+		if (process.stdin.isTTY) {
+			logger.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
+			logger.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
+			process.exit(1);
+		}
+		secretValue = await readStdin();
+		if (!secretValue) {
+			logger.error("No value received from stdin");
+			process.exit(1);
+		}
+	}
+	try {
+		await setCustomSecret(stage, key, secretValue);
+		logger.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
+	} catch (error) {
+		logger.error(error instanceof Error ? error.message : "Failed to set secret");
+		process.exit(1);
+	}
+}
+/**
+* Show secrets for a stage.
+*/
+async function secretsShowCommand(options) {
+	const { stage, reveal } = options;
+	const secrets = await readStageSecrets(stage);
+	if (!secrets) {
+		logger.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		process.exit(1);
+	}
+	logger.log(`\nSecrets for stage "${stage}":`);
+	logger.log(`  Created: ${secrets.createdAt}`);
+	logger.log(`  Updated: ${secrets.updatedAt}`);
+	logger.log("\nService Credentials:");
+	for (const [service, creds] of Object.entries(secrets.services)) if (creds) {
+		logger.log(`\n  ${service}:`);
+		logger.log(`    host: ${creds.host}`);
+		logger.log(`    port: ${creds.port}`);
+		logger.log(`    username: ${creds.username}`);
+		logger.log(`    password: ${reveal ? creds.password : maskPassword(creds.password)}`);
+		if (creds.database) logger.log(`    database: ${creds.database}`);
+		if (creds.vhost) logger.log(`    vhost: ${creds.vhost}`);
+	}
+	logger.log("\nConnection URLs:");
+	if (secrets.urls.DATABASE_URL) logger.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.RABBITMQ_URL) logger.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
+	const customKeys = Object.keys(secrets.custom);
+	if (customKeys.length > 0) {
+		logger.log("\nCustom Secrets:");
+		for (const [key, value] of Object.entries(secrets.custom)) logger.log(`  ${key}: ${reveal ? value : maskPassword(value)}`);
+	}
+	if (!reveal) logger.log("\nUse --reveal to show actual values");
+}
+/**
+* Rotate passwords for services.
+*/
+async function secretsRotateCommand(options) {
+	const { stage, service } = options;
+	const secrets = await readStageSecrets(stage);
+	if (!secrets) {
+		logger.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		process.exit(1);
+	}
+	if (service) {
+		if (!secrets.services[service]) {
+			logger.error(`Service "${service}" not configured in stage "${stage}"`);
+			process.exit(1);
+		}
+		const updated = rotateServicePassword(secrets, service);
+		await writeStageSecrets(updated);
+		logger.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
+	} else {
+		let updated = secrets;
+		const services = Object.keys(secrets.services);
+		for (const svc of services) updated = rotateServicePassword(updated, svc);
+		await writeStageSecrets(updated);
+		logger.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
+	}
+	logger.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
+}
+/**
+* Import secrets from a JSON file.
+*/
+async function secretsImportCommand(file, options) {
+	const { stage, merge = true } = options;
+	if (!existsSync(file)) {
+		logger.error(`File not found: ${file}`);
+		process.exit(1);
+	}
+	let importedSecrets;
+	try {
+		const content = await readFile(file, "utf-8");
+		importedSecrets = JSON.parse(content);
+		if (typeof importedSecrets !== "object" || importedSecrets === null) throw new Error("JSON must be an object");
+		for (const [key, value] of Object.entries(importedSecrets)) if (typeof value !== "string") throw new Error(`Value for "${key}" must be a string, got ${typeof value}`);
+	} catch (error) {
+		logger.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
+		process.exit(1);
+	}
+	const secrets = await readStageSecrets(stage);
+	if (!secrets) {
+		logger.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		process.exit(1);
+	}
+	const updatedCustom = merge ? {
+		...secrets.custom,
+		...importedSecrets
+	} : importedSecrets;
+	const updated = {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: updatedCustom
+	};
+	await writeStageSecrets(updated);
+	const importedCount = Object.keys(importedSecrets).length;
+	const totalCount = Object.keys(updatedCustom).length;
+	logger.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
+	if (merge && totalCount > importedCount) logger.log(`  Total custom secrets: ${totalCount}`);
+	logger.log("\n  Imported keys:");
+	for (const key of Object.keys(importedSecrets)) logger.log(`    - ${key}`);
+}
+/**
+* Mask password in a URL for display.
+*/
+function maskUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (parsed.password) parsed.password = maskPassword(parsed.password);
+		return parsed.toString();
+	} catch {
+		return url;
+	}
 }
 
 //#endregion
@@ -2680,34 +4440,39 @@ program.command("init").description("Scaffold a new project").argument("[name]",
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await initCommand(name$1, options);
-	} catch (error) {
-		console.error("Init failed:", error.message);
+	} catch (_error) {
 		process.exit(1);
 	}
 });
-program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").action(async (options) => {
+program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		if (options.provider) {
-			if (!["aws", "server"].includes(options.provider)) {
-				console.error(`Invalid provider: ${options.provider}. Must be 'aws' or 'server'.`);
-				process.exit(1);
-			}
+			if (!["aws", "server"].includes(options.provider)) process.exit(1);
 			await buildCommand({
 				provider: options.provider,
-				enableOpenApi: options.enableOpenapi || false
+				enableOpenApi: options.enableOpenapi || false,
+				production: options.production || false,
+				skipBundle: options.skipBundle || false,
+				stage: options.stage
 			});
 		} else if (options.providers) {
-			console.warn("⚠️  --providers flag is deprecated. Use --provider instead.");
 			const providerList = [...new Set(options.providers.split(",").map((p) => p.trim()))];
 			await buildCommand({
 				providers: providerList,
-				enableOpenApi: options.enableOpenapi || false
+				enableOpenApi: options.enableOpenapi || false,
+				production: options.production || false,
+				skipBundle: options.skipBundle || false,
+				stage: options.stage
 			});
-		} else await buildCommand({ enableOpenApi: options.enableOpenapi || false });
-	} catch (error) {
-		console.error("Build failed:", error.message);
+		} else await buildCommand({
+			enableOpenApi: options.enableOpenapi || false,
+			production: options.production || false,
+			skipBundle: options.skipBundle || false,
+			stage: options.stage
+		});
+	} catch (_error) {
 		process.exit(1);
 	}
 });
@@ -2716,12 +4481,11 @@ program.command("dev").description("Start development server with automatic relo
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await devCommand({
-			port: options.port ? Number.parseInt(options.port) : 3e3,
+			port: options.port ? Number.parseInt(options.port, 10) : 3e3,
 			portExplicit: !!options.port,
 			enableOpenApi: options.enableOpenapi ?? true
 		});
-	} catch (error) {
-		console.error("Dev server failed:", error.message);
+	} catch (_error) {
 		process.exit(1);
 	}
 });
@@ -2745,8 +4509,7 @@ program.command("openapi").description("Generate OpenAPI specification from endp
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await openapiCommand({});
-	} catch (error) {
-		console.error("OpenAPI generation failed:", error.message);
+	} catch (_error) {
 		process.exit(1);
 	}
 });
@@ -2755,8 +4518,194 @@ program.command("generate:react-query").description("Generate React Query hooks
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await generateReactQueryCommand(options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("docker").description("Generate Docker deployment files").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Use slim Dockerfile (assumes pre-built bundle exists)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await dockerCommand(options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Build locally first, then use slim Dockerfile").option("--skip-bundle", "Skip bundling step (only with --slim)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		if (options.slim) await buildCommand({
+			provider: "server",
+			production: true,
+			skipBundle: options.skipBundle
+		});
+		await dockerCommand({
+			build: options.build,
+			push: options.push,
+			tag: options.tag,
+			registry: options.registry,
+			slim: options.slim,
+			turbo: options.turbo,
+			turboPackage: options.turboPackage
+		});
+		if (options.slim) {}
+		if (options.build) {
+			const tag = options.tag ?? "latest";
+			const registry = options.registry;
+			const _imageRef = registry ? `${registry}/api:${tag}` : `api:${tag}`;
+		}
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("secrets:init").description("Initialize secrets for a deployment stage").requiredOption("--stage <stage>", "Stage name (e.g., production, staging)").option("--force", "Overwrite existing secrets").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsInitCommand(options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("secrets:set").description("Set a custom secret for a stage").argument("<key>", "Secret key (e.g., API_KEY)").argument("[value]", "Secret value (reads from stdin if omitted)").requiredOption("--stage <stage>", "Stage name").action(async (key, value, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsSetCommand(key, value, options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("secrets:show").description("Show secrets for a stage").requiredOption("--stage <stage>", "Stage name").option("--reveal", "Show actual secret values (not masked)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsShowCommand(options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("secrets:rotate").description("Rotate service passwords").requiredOption("--stage <stage>", "Stage name").option("--service <service>", "Specific service to rotate (postgres, redis, rabbitmq)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsRotateCommand(options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("secrets:import").description("Import secrets from a JSON file").argument("<file>", "JSON file path (e.g., secrets.json)").requiredOption("--stage <stage>", "Stage name").option("--no-merge", "Replace all custom secrets instead of merging").action(async (file, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsImportCommand(file, options);
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("deploy").description("Deploy application to a provider").requiredOption("--provider <provider>", "Deploy provider (docker, dokploy, aws-lambda)").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const validProviders = [
+			"docker",
+			"dokploy",
+			"aws-lambda"
+		];
+		if (!validProviders.includes(options.provider)) {
+			console.error(`Invalid provider: ${options.provider}\nValid providers: ${validProviders.join(", ")}`);
+			process.exit(1);
+		}
+		await deployCommand({
+			provider: options.provider,
+			stage: options.stage,
+			tag: options.tag,
+			skipPush: options.skipPush,
+			skipBuild: options.skipBuild
+		});
+	} catch (_error) {
+		process.exit(1);
+	}
+});
+program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await deployInitCommand({
+			endpoint: options.endpoint,
+			projectName: options.project,
+			appName: options.app,
+			projectId: options.projectId,
+			registryId: options.registryId
+		});
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Failed to initialize deployment");
+		process.exit(1);
+	}
+});
+program.command("deploy:list").description("List Dokploy resources (projects, registries)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").option("--projects", "List projects").option("--registries", "List registries").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		if (options.projects) await deployListCommand({
+			endpoint: options.endpoint,
+			resource: "projects"
+		});
+		if (options.registries) await deployListCommand({
+			endpoint: options.endpoint,
+			resource: "registries"
+		});
+		if (!options.projects && !options.registries) {
+			await deployListCommand({
+				endpoint: options.endpoint,
+				resource: "projects"
+			});
+			await deployListCommand({
+				endpoint: options.endpoint,
+				resource: "registries"
+			});
+		}
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Failed to list resources");
+		process.exit(1);
+	}
+});
+program.command("login").description("Authenticate with a deployment service").option("--service <service>", "Service to login to (dokploy)", "dokploy").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		if (options.service !== "dokploy") {
+			console.error(`Unknown service: ${options.service}. Supported: dokploy`);
+			process.exit(1);
+		}
+		await loginCommand({
+			service: options.service,
+			token: options.token,
+			endpoint: options.endpoint
+		});
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Failed to login");
+		process.exit(1);
+	}
+});
+program.command("logout").description("Remove stored credentials").option("--service <service>", "Service to logout from (dokploy, all)", "dokploy").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await logoutCommand({ service: options.service });
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Failed to logout");
+		process.exit(1);
+	}
+});
+program.command("whoami").description("Show current authentication status").action(async () => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await whoamiCommand();
 	} catch (error) {
-		console.error("React Query generation failed:", error.message);
+		console.error(error instanceof Error ? error.message : "Failed to get status");
 		process.exit(1);
 	}
 });