@geekmidas/cli 1.10.41 → 1.12.0

package/dist/index.cjs

@@ -5,12 +5,13 @@ const require_config = require('./config-DujV8DbR.cjs');
 const require_credentials = require('./credentials-C8DWtnMY.cjs');
 const require_fullstack_secrets = require('./fullstack-secrets-BYzi6Hwl.cjs');
 const require_storage = require('./storage-B1wvztiJ.cjs');
-const require_openapi = require('./openapi-DHp49UJV.cjs');
-const require_dokploy_api = require('./dokploy-api-Dvyq-LsM.cjs');
-const require_encryption = require('./encryption-DgKS-Dv9.cjs');
-const require_CachedStateProvider = require('./CachedStateProvider-CxsXOKkg.cjs');
-const require_openapi_react_query = require('./openapi-react-query-DYbBq-WJ.cjs');
-const require_sync = require('./sync-DGXXSk2v.cjs');
+const require_setup = require('./setup-WZ-xqAQO.cjs');
+const require_openapi = require('./openapi-BzNOC7_i.cjs');
+const require_dokploy_api = require('./dokploy-api-CqOIKHme.cjs');
+const require_encryption = require('./encryption-MfXAiFTm.cjs');
+const require_CachedStateProvider = require('./CachedStateProvider-klLWZXWF.cjs');
+const require_openapi_react_query = require('./openapi-react-query-CYWik72n.cjs');
+require('./sync-o_CtEbvR.cjs');
 const node_fs = require_chunk.__toESM(require("node:fs"));
 const node_path = require_chunk.__toESM(require("node:path"));
 const commander = require_chunk.__toESM(require("commander"));
@@ -20,13 +21,13 @@ const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
 const node_child_process = require_chunk.__toESM(require("node:child_process"));
 const chokidar = require_chunk.__toESM(require("chokidar"));
 const fast_glob = require_chunk.__toESM(require("fast-glob"));
-const node_net = require_chunk.__toESM(require("node:net"));
-const dotenv = require_chunk.__toESM(require("dotenv"));
 const yaml = require_chunk.__toESM(require("yaml"));
 const node_crypto = require_chunk.__toESM(require("node:crypto"));
 const __geekmidas_constructs_crons = require_chunk.__toESM(require("@geekmidas/constructs/crons"));
 const __geekmidas_constructs_functions = require_chunk.__toESM(require("@geekmidas/constructs/functions"));
+const __geekmidas_constructs_queue = require_chunk.__toESM(require("@geekmidas/constructs/queue"));
 const __geekmidas_constructs_subscribers = require_chunk.__toESM(require("@geekmidas/constructs/subscribers"));
+const __geekmidas_constructs_topic = require_chunk.__toESM(require("@geekmidas/constructs/topic"));
 const node_url = require_chunk.__toESM(require("node:url"));
 const pg = require_chunk.__toESM(require("pg"));
 const node_dns_promises = require_chunk.__toESM(require("node:dns/promises"));
@@ -35,7 +36,7 @@ const prompts = require_chunk.__toESM(require("prompts"));
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.10.40";
+var version = "1.11.0";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -115,6 +116,7 @@ var dependencies = {
 	"@geekmidas/envkit": "workspace:~",
 	"@geekmidas/errors": "workspace:~",
 	"@geekmidas/logger": "workspace:~",
+	"@geekmidas/manifest": "workspace:*",
 	"@geekmidas/schema": "workspace:~",
 	"chokidar": "~4.0.3",
 	"commander": "^12.1.0",
@@ -158,12 +160,12 @@ var package_default = {
 
 //#endregion
 //#region src/auth/index.ts
-const logger$14 = console;
+const logger$12 = console;
 /**
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BOx71j6F.cjs"));
+	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BPYkG-ZZ.cjs"));
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -177,7 +179,7 @@ async function prompt$1(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please provide --token option.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$4, reject) => {
+		return new Promise((resolve$3, reject) => {
 			let value = "";
 			const cleanup = () => {
 				process.stdin.setRawMode(false);
@@ -194,7 +196,7 @@ async function prompt$1(message, hidden = false) {
 				if (c === "\n" || c === "\r") {
 					cleanup();
 					process.stdout.write("\n");
-					resolve$4(value);
+					resolve$3(value);
 				} else if (c === "") {
 					cleanup();
 					process.stdout.write("\n");
@@ -226,36 +228,36 @@ async function prompt$1(message, hidden = false) {
 async function loginCommand(options) {
 	const { service, token: providedToken, endpoint: providedEndpoint } = options;
 	if (service === "dokploy") {
-		logger$14.log("\n🔐 Logging in to Dokploy...\n");
+		logger$12.log("\n🔐 Logging in to Dokploy...\n");
 		let endpoint = providedEndpoint;
 		if (!endpoint) endpoint = await prompt$1("Dokploy URL (e.g., https://dokploy.example.com): ");
 		endpoint = endpoint.replace(/\/$/, "");
 		try {
 			new URL(endpoint);
 		} catch {
-			logger$14.error("Invalid URL format");
+			logger$12.error("Invalid URL format");
 			process.exit(1);
 		}
 		let token = providedToken;
 		if (!token) {
-			logger$14.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			logger$12.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
 			token = await prompt$1("API Token: ", true);
 		}
 		if (!token) {
-			logger$14.error("Token is required");
+			logger$12.error("Token is required");
 			process.exit(1);
 		}
-		logger$14.log("\nValidating credentials...");
+		logger$12.log("\nValidating credentials...");
 		const isValid = await validateDokployToken(endpoint, token);
 		if (!isValid) {
-			logger$14.error("\n✗ Invalid credentials. Please check your token and try again.");
+			logger$12.error("\n✗ Invalid credentials. Please check your token and try again.");
 			process.exit(1);
 		}
 		await require_credentials.storeDokployCredentials(token, endpoint);
-		logger$14.log("\n✓ Successfully logged in to Dokploy!");
-		logger$14.log(`  Endpoint: ${endpoint}`);
-		logger$14.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
-		logger$14.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+		logger$12.log("\n✓ Successfully logged in to Dokploy!");
+		logger$12.log(`  Endpoint: ${endpoint}`);
+		logger$12.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
+		logger$12.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
 }
 /**
@@ -265,28 +267,28 @@ async function logoutCommand(options) {
 	const { service = "dokploy" } = options;
 	if (service === "all") {
 		const dokployRemoved = await require_credentials.removeDokployCredentials();
-		if (dokployRemoved) logger$14.log("\n✓ Logged out from all services");
-		else logger$14.log("\nNo stored credentials found");
+		if (dokployRemoved) logger$12.log("\n✓ Logged out from all services");
+		else logger$12.log("\nNo stored credentials found");
 		return;
 	}
 	if (service === "dokploy") {
 		const removed = await require_credentials.removeDokployCredentials();
-		if (removed) logger$14.log("\n✓ Logged out from Dokploy");
-		else logger$14.log("\nNo Dokploy credentials found");
+		if (removed) logger$12.log("\n✓ Logged out from Dokploy");
+		else logger$12.log("\nNo Dokploy credentials found");
 	}
 }
 /**
 * Show current login status
 */
 async function whoamiCommand() {
-	logger$14.log("\n📋 Current credentials:\n");
+	logger$12.log("\n📋 Current credentials:\n");
 	const dokploy = await require_credentials.getDokployCredentials();
 	if (dokploy) {
-		logger$14.log("  Dokploy:");
-		logger$14.log(`    Endpoint: ${dokploy.endpoint}`);
-		logger$14.log(`    Token: ${maskToken(dokploy.token)}`);
-	} else logger$14.log("  Dokploy: Not logged in");
-	logger$14.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
+		logger$12.log("  Dokploy:");
+		logger$12.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$12.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$12.log("  Dokploy: Not logged in");
+	logger$12.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
 }
 /**
 * Mask a token for display
@@ -367,477 +369,12 @@ function isEnabled(config) {
 	return config.enabled !== false;
 }
 
-//#endregion
-//#region src/credentials/index.ts
-const logger$13 = console;
-/**
-* Load environment files
-* @internal Exported for testing
-*/
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = (0, node_path.resolve)(cwd, envFile);
-		if ((0, node_fs.existsSync)(envPath)) {
-			(0, dotenv.config)({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
-}
-/**
-* Check if a port is available
-* @internal Exported for testing
-*/
-async function isPortAvailable(port) {
-	return new Promise((resolve$4) => {
-		const server = (0, node_net.createServer)();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$4(false);
-			else resolve$4(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve$4(true);
-		});
-		server.listen(port);
-	});
-}
-/**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
-*/
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger$13.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
-	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
-}
-const PORT_STATE_PATH = ".gkm/ports.json";
-/**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
-*/
-function parseComposePortMappings(composePath) {
-	if (!(0, node_fs.existsSync)(composePath)) return [];
-	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
-	const compose = (0, yaml.parse)(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
-}
-/**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function loadPortState(workspaceRoot) {
-	try {
-		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-/**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function savePortState(workspaceRoot, ports) {
-	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
-/**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
-*/
-function getContainerHostPort(workspaceRoot, service, containerPort) {
-	try {
-		const result = (0, node_child_process.execSync)(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim();
-		const match = result.match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function resolveServicePorts(workspaceRoot) {
-	const composePath = (0, node_path.join)(workspaceRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger$13.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger$13.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger$13.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger$13.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger$13.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
-	}
-	await savePortState(workspaceRoot, ports);
-	return {
-		dockerEnv,
-		ports,
-		mappings
-	};
-}
-/**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
-*/
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
-}
-/**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
-*/
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name$1 of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name$1}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
-	}
-	return result;
-}
-/**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
-*/
-function buildDockerComposeEnv(secretsEnv, portEnv) {
-	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
-	};
-}
-/**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
-*/
-function parseComposeServiceNames(composePath) {
-	if (!(0, node_fs.existsSync)(composePath)) return [];
-	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
-	const compose = (0, yaml.parse)(content);
-	return Object.keys(compose?.services ?? {});
-}
-/**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
-*/
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = (0, node_path.join)(cwd, "docker-compose.yml");
-	if (!(0, node_fs.existsSync)(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger$13.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger$13.log("✅ Services started");
-	} catch (error) {
-		logger$13.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
-*/
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
-	if (!(0, node_fs.existsSync)(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name$1) => !appNames.has(name$1));
-	if (servicesToStart.length === 0) return;
-	logger$13.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger$13.log("✅ Services started");
-	} catch (error) {
-		logger$13.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
-/**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
-*/
-async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
-	let secrets = {};
-	for (const stage of stages) if (require_storage.secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await require_storage.readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger$13.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = require_storage.toEmbeddableSecrets(stageSecrets);
-			break;
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
-}
-/**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
-*/
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if ((0, node_fs.existsSync)((0, node_path.join)(dir, ".gkm", "secrets"))) return dir;
-		const parent = (0, node_path.dirname)(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
-/**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
-*/
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
-}
-`;
-}
-/**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
-*/
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await (0, node_fs_promises.writeFile)(preloadPath, content);
-}
-/**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
-*/
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : "";
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await (0, node_fs_promises.writeFile)(wrapperPath, content);
-}
-/**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
-*
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
-*/
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	try {
-		appInfo = await require_config.loadWorkspaceAppInfo(cwd);
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		secretsRoot = findSecretsRoot(cwd);
-		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
-	credentials.PORT = String(resolvedPort);
-	const composePath = (0, node_path.join)(secretsRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
-	if (mappings.length > 0) {
-		let resolvedPorts;
-		if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-		else {
-			const savedPorts = await loadPortState(secretsRoot);
-			const ports = {};
-			for (const mapping of mappings) {
-				const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-				if (containerPort !== null) ports[mapping.envVar] = containerPort;
-				else {
-					const saved = savedPorts[mapping.envVar];
-					if (saved !== void 0) ports[mapping.envVar] = saved;
-				}
-			}
-			resolvedPorts = {
-				dockerEnv: {},
-				ports,
-				mappings
-			};
-		}
-		if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-		else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-		if (Object.keys(resolvedPorts.ports).length > 0) {
-			const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-			Object.assign(credentials, rewritten);
-			logger$13.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		Object.assign(credentials, depEnv);
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = require_fullstack_secrets.generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
-	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
-	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo
-	};
-}
-
 //#endregion
 //#region src/generators/CronGenerator.ts
 var CronGenerator = class extends require_openapi.ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$15 = console;
+		const logger$13 = console;
 		const cronInfos = [];
 		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
 		const cronsDir = (0, node_path.join)(outputDir, "crons");
@@ -852,7 +389,7 @@ var CronGenerator = class extends require_openapi.ConstructGenerator {
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
-			logger$15.log(`Generated cron handler: ${key}`);
+			logger$13.log(`Generated cron handler: ${key}`);
 		}
 		return cronInfos;
 	}
@@ -888,7 +425,7 @@ var FunctionGenerator = class extends require_openapi.ConstructGenerator {
 	}
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$15 = console;
+		const logger$13 = console;
 		const functionInfos = [];
 		if (constructs.length === 0 || provider !== "aws-lambda") return functionInfos;
 		const functionsDir = (0, node_path.join)(outputDir, "functions");
@@ -902,7 +439,7 @@ var FunctionGenerator = class extends require_openapi.ConstructGenerator {
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
-			logger$15.log(`Generated function handler: ${key}`);
+			logger$13.log(`Generated function handler: ${key}`);
 		}
 		return functionInfos;
 	}
@@ -927,6 +464,176 @@ export const handler = adapter.handler;
 	}
 };
 
+//#endregion
+//#region src/generators/QueueGenerator.ts
+/**
+* Generates the runtime for `q` queue workers.
+*
+* - **server** (`gkm dev`): a single `queues.ts` exposing `setupQueues()` that
+*   runs an in-process pg-boss poller alongside the Hono server — no SQS/Lambda.
+*   Each queue subscribes by its **name** on the shared event connection.
+* - **aws-lambda**: one handler file per queue wrapping `AWSLambdaQueue`, backed
+*   by an SQS event-source mapping.
+*/
+var QueueGenerator = class extends require_openapi.ConstructGenerator {
+	isConstruct(value) {
+		return __geekmidas_constructs_queue.Queue.isQueue(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		const provider = options?.provider || "aws-lambda";
+		const logger$13 = console;
+		const queueInfos = [];
+		if (provider === "server") {
+			await this.generateServerQueuesFile(outputDir, constructs);
+			logger$13.log(`Generated server queues file with ${constructs.length} queues (polling mode)`);
+			return queueInfos;
+		}
+		if (constructs.length === 0 || provider !== "aws-lambda") return queueInfos;
+		const queuesDir = (0, node_path.join)(outputDir, "queues");
+		await (0, node_fs_promises.mkdir)(queuesDir, { recursive: true });
+		for (const { key, construct, path } of constructs) {
+			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context);
+			queueInfos.push({
+				name: construct.name,
+				handler: (0, node_path.relative)(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				batchSize: construct.batchSize,
+				fifo: construct.fifo,
+				timeout: construct.timeout,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional })
+			});
+			logger$13.log(`Generated queue handler: ${key}`);
+		}
+		return queueInfos;
+	}
+	async generateQueueHandler(outputDir, sourceFile, exportName, context) {
+		const handlerPath = (0, node_path.join)(outputDir, `${exportName}.ts`);
+		const importPath = (0, node_path.relative)((0, node_path.dirname)(handlerPath), sourceFile).replace(/\.ts$/, ".js");
+		const relativeEnvParserPath = (0, node_path.relative)((0, node_path.dirname)(handlerPath), context.envParserPath);
+		const content = `import { AWSLambdaQueue } from '@geekmidas/constructs/aws';
+import { ${exportName} } from '${importPath}';
+import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
+
+const adapter = new AWSLambdaQueue(envParser, ${exportName});
+
+export const handler = adapter.handler;
+`;
+		await (0, node_fs_promises.writeFile)(handlerPath, content);
+		return handlerPath;
+	}
+	async generateServerQueuesFile(outputDir, queues) {
+		await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+		const queuesPath = (0, node_path.join)(outputDir, "queues.ts");
+		const importsByFile = /* @__PURE__ */ new Map();
+		for (const { path, key } of queues) {
+			const importPath = (0, node_path.relative)((0, node_path.dirname)(queuesPath), path.relative).replace(/\.ts$/, ".js");
+			if (!importsByFile.has(importPath)) importsByFile.set(importPath, []);
+			importsByFile.get(importPath)?.push(key);
+		}
+		const imports = Array.from(importsByFile.entries()).map(([importPath, exports$2]) => `import { ${exports$2.join(", ")} } from '${importPath}';`).join("\n");
+		const allExportNames = queues.map(({ key }) => key);
+		const content = `/**
+ * Generated queue workers setup
+ *
+ * ⚠️  WARNING: This is for LOCAL DEVELOPMENT ONLY
+ * This runs an in-process pg-boss poller alongside the HTTP server. Each queue
+ * subscribes by its name on the shared event connection
+ * (EVENT_SUBSCRIBER_CONNECTION_STRING), so producers using
+ * <NAME>_PUBLISHER_CONNECTION_STRING (pgboss:// locally) reach it.
+ *
+ * For production, queues run as AWS Lambda with SQS event-source mappings.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
+import type { EventConnection, EventSubscriber } from '@geekmidas/events';
+import { ServiceDiscovery } from '@geekmidas/services';
+${imports}
+
+const queues = [
+  ${allExportNames.join(",\n  ")}
+];
+
+const activeSubscribers: EventSubscriber<any>[] = [];
+
+export async function setupQueues(
+  envParser: EnvironmentParser<any>,
+  logger: Logger,
+): Promise<void> {
+  if (queues.length === 0) {
+    return;
+  }
+
+  logger.info('Setting up queue workers in polling mode (local development)');
+
+  const config = envParser.create((get) => ({
+    connectionString: get('EVENT_SUBSCRIBER_CONNECTION_STRING').string(),
+  })).parse();
+
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+
+  let connection: EventConnection;
+  try {
+    connection = await EventConnectionFactory.fromConnectionString(config.connectionString);
+    const connectionType = new URL(config.connectionString).protocol.replace(':', '');
+    logger.info({ connectionType }, 'Created shared event connection for queues');
+  } catch (error) {
+    logger.error({ error }, 'Failed to create event connection for queues');
+    return;
+  }
+
+  for (const queue of queues) {
+    try {
+      const eventSubscriber = await Subscriber.fromConnection(connection);
+
+      const services = queue.services.length > 0
+        ? await serviceDiscovery.register(queue.services)
+        : {};
+
+      // A queue subscribes to a single "type" — its own name.
+      await eventSubscriber.subscribe([queue.name], async (message) => {
+        try {
+          const validation = await queue.messageSchema['~standard'].validate(message.payload);
+          if (validation.issues) {
+            logger.error({ issues: validation.issues, queue: queue.name }, 'Queue message failed validation');
+            return;
+          }
+
+          await queue.handler({
+            messages: [validation.value],
+            services: services,
+            logger: queue.logger,
+          });
+
+          logger.debug({ queue: queue.name }, 'Successfully processed queue message');
+        } catch (error) {
+          logger.error({ error, queue: queue.name }, 'Failed to process queue message');
+          // Message will become visible again for retry.
+        }
+      });
+
+      activeSubscribers.push(eventSubscriber);
+      logger.info({ queue: queue.name }, 'Queue worker started polling');
+    } catch (error) {
+      logger.error({ error, queue: queue.name }, 'Failed to setup queue worker');
+    }
+  }
+
+  const shutdown = () => {
+    logger.info('Stopping all queue workers');
+    for (const _ of activeSubscribers) {
+      connection.stop();
+    }
+  };
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+}
+`;
+		await (0, node_fs_promises.writeFile)(queuesPath, content);
+		return queuesPath;
+	}
+};
+
 //#endregion
 //#region src/generators/SubscriberGenerator.ts
 var SubscriberGenerator = class extends require_openapi.ConstructGenerator {
@@ -935,11 +642,11 @@ var SubscriberGenerator = class extends require_openapi.ConstructGenerator {
 	}
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$15 = console;
+		const logger$13 = console;
 		const subscriberInfos = [];
 		if (provider === "server") {
 			await this.generateServerSubscribersFile(outputDir, constructs);
-			logger$15.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
+			logger$13.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
 			return subscriberInfos;
 		}
 		if (constructs.length === 0) return subscriberInfos;
@@ -952,11 +659,15 @@ var SubscriberGenerator = class extends require_openapi.ConstructGenerator {
 				name: key,
 				handler: (0, node_path.relative)(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				subscribedEvents: construct.subscribedEvents || [],
+				...construct.topicName ? {
+					transport: "topic",
+					topic: construct.topicName
+				} : {},
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment({ markOptional: context.markOptional })
 			});
-			logger$15.log(`Generated subscriber handler: ${key}`);
+			logger$13.log(`Generated subscriber handler: ${key}`);
 		}
 		return subscriberInfos;
 	}
@@ -1120,9 +831,35 @@ export async function setupSubscribers(
 	}
 };
 
+//#endregion
+//#region src/generators/TopicGenerator.ts
+/**
+* Discovers `t` topics into `manifest.topics`. A topic is a *resource*, not a
+* function — it has no handler to generate. Producers reach it via its derived
+* publisher (`topic.publisher`, whose connection string is sniffed onto the
+* producing construct) and subscribers bind via `s.topic(topic)`; this generator
+* only records the topic + its event contract so infra can provision the SNS
+* topic. Identical output for every provider (locally pg-boss routes by event
+* name, so there's nothing to run).
+*/
+var TopicGenerator = class extends require_openapi.ConstructGenerator {
+	isConstruct(value) {
+		return __geekmidas_constructs_topic.Topic.isTopic(value);
+	}
+	async build(_context, constructs, _outputDir, _options) {
+		const logger$13 = console;
+		const topicInfos = constructs.map(({ construct }) => ({
+			name: construct.name,
+			events: construct.eventTypes
+		}));
+		for (const topic of topicInfos) logger$13.log(`Discovered topic: ${topic.name}`);
+		return topicInfos;
+	}
+};
+
 //#endregion
 //#region src/exec/index.ts
-const logger$12 = console;
+const logger$11 = console;
 /**
 * Run a command with secrets injected into Credentials.
 * Uses Node's --import flag to preload a script that populates Credentials
@@ -1137,22 +874,22 @@ const logger$12 = console;
 async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (commandArgs.length === 0) throw new Error("No command specified. Usage: gkm exec -- <command>");
-	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({
+	const defaultEnv = require_setup.loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, secretsJsonPath, appName } = await require_setup.prepareEntryCredentials({
 		cwd,
 		resolveDockerPorts: "readonly"
 	});
-	if (appName) logger$12.log(`📦 App: ${appName}`);
+	if (appName) logger$11.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$11.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
-	await createCredentialsPreload(preloadPath, secretsJsonPath);
+	await require_setup.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
 	if (!cmd) throw new Error("No command specified");
-	logger$12.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$11.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const existingNodeOptions = (process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim();
 	const preloadImport = `--import=${preloadPath}`;
 	const nodeOptions = [existingNodeOptions, preloadImport].filter(Boolean).join(" ");
@@ -1165,11 +902,11 @@ async function execCommand(commandArgs, options = {}) {
 			NODE_OPTIONS: nodeOptions
 		}
 	});
-	const exitCode = await new Promise((resolve$4) => {
-		child.on("close", (code) => resolve$4(code ?? 0));
+	const exitCode = await new Promise((resolve$3) => {
+		child.on("close", (code) => resolve$3(code ?? 0));
 		child.on("error", (error) => {
-			logger$12.error(`Failed to run command: ${error.message}`);
-			resolve$4(1);
+			logger$11.error(`Failed to run command: ${error.message}`);
+			resolve$3(1);
 		});
 	});
 	if (exitCode !== 0) process.exit(exitCode);
@@ -1177,7 +914,7 @@ async function execCommand(commandArgs, options = {}) {
 
 //#endregion
 //#region src/dev/index.ts
-const logger$11 = console;
+const logger$10 = console;
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1274,8 +1011,8 @@ function getProductionConfigFromGkm(config) {
 }
 async function devCommand(options) {
 	if (options.entry) return entryDevCommand(options);
-	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const defaultEnv = require_setup.loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appName = require_config.getAppNameFromCwd();
 	let config;
 	let appRoot = process.cwd();
@@ -1291,9 +1028,9 @@ async function devCommand(options) {
 		workspaceAppName = appConfig.appName;
 		workspaceAppPort = appConfig.app.port;
 		workspace = appConfig.workspace;
-		logger$11.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
+		logger$10.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
 		if (appConfig.app.entry) {
-			logger$11.log(`📄 Using entry point: ${appConfig.app.entry}`);
+			logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
 			return entryDevCommand({
 				...options,
 				entry: appConfig.app.entry,
@@ -1304,7 +1041,7 @@ async function devCommand(options) {
 	} catch {
 		const loadedConfig = await require_config.loadWorkspaceConfig();
 		if (loadedConfig.type === "workspace") {
-			logger$11.log("📦 Detected workspace configuration");
+			logger$10.log("📦 Detected workspace configuration");
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config = loadedConfig.raw;
@@ -1312,34 +1049,34 @@ async function devCommand(options) {
 	else {
 		const loadedConfig = await require_config.loadWorkspaceConfig();
 		if (loadedConfig.type === "workspace") {
-			logger$11.log("📦 Detected workspace configuration");
+			logger$10.log("📦 Detected workspace configuration");
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config = loadedConfig.raw;
 	}
 	if (config.env) {
-		const { loaded, missing } = loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$11.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$11.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		const { loaded, missing } = require_setup.loadEnvFiles(config.env, appRoot);
+		if (loaded.length > 0) logger$10.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$10.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const resolved = resolveProviders(config, { provider: "server" });
-	logger$11.log("🚀 Starting development server...");
-	logger$11.log(`Loading routes from: ${config.routes}`);
-	if (config.functions) logger$11.log(`Loading functions from: ${config.functions}`);
-	if (config.crons) logger$11.log(`Loading crons from: ${config.crons}`);
-	if (config.subscribers) logger$11.log(`Loading subscribers from: ${config.subscribers}`);
-	logger$11.log(`Using envParser: ${config.envParser}`);
+	logger$10.log("🚀 Starting development server...");
+	logger$10.log(`Loading routes from: ${config.routes}`);
+	if (config.functions) logger$10.log(`Loading functions from: ${config.functions}`);
+	if (config.crons) logger$10.log(`Loading crons from: ${config.crons}`);
+	if (config.subscribers) logger$10.log(`Loading subscribers from: ${config.subscribers}`);
+	logger$10.log(`Using envParser: ${config.envParser}`);
 	const { path: envParserPath, importPattern: envParserImportPattern } = require_config.parseModuleConfig(config.envParser, "envParser");
 	const { path: loggerPath, importPattern: loggerImportPattern } = require_config.parseModuleConfig(config.logger, "logger");
 	const telescope = normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$11.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$10.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = normalizeStudioConfig(config.studio);
-	if (studio) logger$11.log(`🗄️  Studio enabled at ${studio.path}`);
+	if (studio) logger$10.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	if (hooks) logger$11.log(`🪝 Server hooks enabled from ${config.hooks?.server}`);
+	if (hooks) logger$10.log(`🪝 Server hooks enabled from ${config.hooks?.server}`);
 	const openApiConfig = require_openapi.resolveOpenApiConfig(config);
 	const enableOpenApi = openApiConfig.enabled || resolved.enableOpenApi;
-	if (enableOpenApi) logger$11.log(`📄 OpenAPI output: ${require_openapi.OPENAPI_OUTPUT_PATH}`);
+	if (enableOpenApi) logger$10.log(`📄 OpenAPI output: ${require_openapi.OPENAPI_OUTPUT_PATH}`);
 	const buildContext = {
 		envParserPath,
 		envParserImportPattern,
@@ -1353,12 +1090,12 @@ async function devCommand(options) {
 	if (enableOpenApi) await require_openapi.generateOpenApi(config);
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
-	const appSecrets = await loadSecretsForApp(secretsRoot, workspaceAppName);
-	const resolvedPorts = await resolveServicePorts(secretsRoot);
+	const appSecrets = await require_setup.loadSecretsForApp(secretsRoot, workspaceAppName);
+	const resolvedPorts = await require_setup.resolveServicePorts(secretsRoot);
 	if (Object.keys(resolvedPorts.ports).length > 0) {
-		const rewritten = rewriteUrlsWithPorts(appSecrets, resolvedPorts);
+		const rewritten = require_setup.rewriteUrlsWithPorts(appSecrets, resolvedPorts);
 		Object.assign(appSecrets, rewritten);
-		logger$11.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
+		logger$10.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
 	}
 	if (workspace && workspaceAppName) {
 		const depEnv = require_workspace.getDependencyEnvVars(workspace, workspaceAppName);
@@ -1370,7 +1107,7 @@ async function devCommand(options) {
 		const secretsFileName = workspaceAppName ? `dev-secrets-${workspaceAppName}.json` : "dev-secrets.json";
 		secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
 		await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
-		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
+		logger$10.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
 	}
 	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? false, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath);
 	await devServer.start();
@@ -1388,7 +1125,7 @@ async function devCommand(options) {
 		...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []
 	].flat().filter((p) => typeof p === "string");
 	const normalizedPatterns = watchPatterns.map((p) => p.startsWith("./") ? p.slice(2) : p);
-	logger$11.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
+	logger$10.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
 	const resolvedFiles = await (0, fast_glob.default)(normalizedPatterns, {
 		cwd: appRoot,
 		absolute: false,
@@ -1398,7 +1135,7 @@ async function devCommand(options) {
 		const parts = f.split("/");
 		return parts.slice(0, -1).join("/");
 	}))];
-	logger$11.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
+	logger$10.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
 	const watcher = chokidar.default.watch([...resolvedFiles, ...dirsToWatch], {
 		ignored: /(^|[/\\])\../,
 		persistent: true,
@@ -1406,29 +1143,29 @@ async function devCommand(options) {
 		cwd: appRoot
 	});
 	watcher.on("ready", () => {
-		logger$11.log("🔍 File watcher ready");
+		logger$10.log("🔍 File watcher ready");
 	});
 	watcher.on("error", (error) => {
-		logger$11.error("❌ Watcher error:", error);
+		logger$10.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$11.log(`📝 File changed: ${path}`);
+		logger$10.log(`📝 File changed: ${path}`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
-				logger$11.log("🔄 Rebuilding...");
+				logger$10.log("🔄 Rebuilding...");
 				await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot, true);
 				if (enableOpenApi) await require_openapi.generateOpenApi(config, {
 					silent: true,
 					bustCache: true
 				});
-				logger$11.log("✅ Rebuild complete, restarting server...");
+				logger$10.log("✅ Rebuild complete, restarting server...");
 				await devServer.restart();
 			} catch (error) {
 				const err = error;
-				logger$11.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$11.error(err.stack);
+				logger$10.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$10.error(err.stack);
 			}
 		}, 300);
 	});
@@ -1436,9 +1173,9 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down...");
+		logger$10.log("\n🛑 Shutting down...");
 		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
-			logger$11.error("Error during shutdown:", err);
+			logger$10.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -1637,11 +1374,11 @@ async function loadDevSecrets(workspace) {
 	for (const stage of stages) if (require_storage.secretsExist(stage, workspace.root)) {
 		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
 		if (secrets) {
-			logger$11.log(`🔐 Loading secrets from stage: ${stage}`);
+			logger$10.log(`🔐 Loading secrets from stage: ${stage}`);
 			return require_storage.toEmbeddableSecrets(secrets);
 		}
 	}
-	logger$11.warn("⚠️  Secrets enabled but no dev/development secrets found. Run \"gkm setup\" to initialize your development environment");
+	logger$10.warn("⚠️  Secrets enabled but no dev/development secrets found. Run \"gkm setup\" to initialize your development environment");
 	return {};
 }
 /**
@@ -1658,39 +1395,39 @@ async function workspaceDevCommand(workspace, options) {
 	const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend");
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
 	const mobileApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "mobile");
-	logger$11.log(`\n🚀 Starting workspace: ${workspace.name}`);
+	logger$10.log(`\n🚀 Starting workspace: ${workspace.name}`);
 	const counts = [`${backendApps.length} backend`, `${frontendApps.length} web`];
 	if (mobileApps.length > 0) counts.push(`${mobileApps.length} mobile`);
-	logger$11.log(`   ${counts.join(", ")} app(s)`);
+	logger$10.log(`   ${counts.join(", ")} app(s)`);
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$11.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$10.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
-		logger$11.log("\n🔍 Validating frontend apps...");
+		logger$10.log("\n🔍 Validating frontend apps...");
 		const validationResults = await validateFrontendApps(workspace);
 		let hasErrors = false;
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$11.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$11.error(`   • ${error}`);
+				logger$10.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$10.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$11.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$10.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
-		logger$11.log("✅ Frontend apps validated");
+		logger$10.log("✅ Frontend apps validated");
 	}
-	const resolvedPorts = await resolveServicePorts(workspace.root);
+	const resolvedPorts = await require_setup.resolveServicePorts(workspace.root);
 	const rawSecrets = await loadDevSecrets(workspace);
-	await startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
-	const secretsEnv = rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
-	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
+	await require_setup.startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
+	const secretsEnv = require_setup.rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
+	if (Object.keys(secretsEnv).length > 0) logger$10.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
 	const dependencyEnv = generateAllDependencyEnvVars(workspace);
 	if (Object.keys(dependencyEnv).length > 0) {
-		logger$11.log("📡 Dependency URLs:");
-		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
+		logger$10.log("📡 Dependency URLs:");
+		for (const [key, value] of Object.entries(dependencyEnv)) logger$10.log(`   ${key}=${value}`);
 	}
 	let turboFilter = [];
 	if (options.app) {
@@ -1699,19 +1436,19 @@ async function workspaceDevCommand(workspace, options) {
 			throw new Error(`App "${options.app}" not found. Available apps: ${appNames}`);
 		}
 		turboFilter = ["--filter", options.app];
-		logger$11.log(`\n🎯 Running single app: ${options.app}`);
+		logger$10.log(`\n🎯 Running single app: ${options.app}`);
 	} else if (options.filter) {
 		turboFilter = ["--filter", options.filter];
-		logger$11.log(`\n🔍 Using filter: ${options.filter}`);
-	} else logger$11.log(`\n🎯 Running all ${appCount} apps`);
+		logger$10.log(`\n🔍 Using filter: ${options.filter}`);
+	} else logger$10.log(`\n🎯 Running all ${appCount} apps`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	logger$11.log("\n📋 Apps (in dependency order):");
+	logger$10.log("\n📋 Apps (in dependency order):");
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
 		const deps = app.dependencies.length > 0 ? ` (depends on: ${app.dependencies.join(", ")})` : "";
 		const icon = app.type === "backend" ? "🔧" : app.type === "mobile" ? "📱" : "🌐";
-		logger$11.log(`   ${icon} ${appName} → http://localhost:${app.port}${deps}`);
+		logger$10.log(`   ${icon} ${appName} → http://localhost:${app.port}${deps}`);
 	}
 	const configFiles = [
 		"gkm.config.ts",
@@ -1733,7 +1470,7 @@ async function workspaceDevCommand(workspace, options) {
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
 	};
-	logger$11.log("\n🏃 Starting turbo run dev...\n");
+	logger$10.log("\n🏃 Starting turbo run dev...\n");
 	const turboProcess = (0, node_child_process.spawn)("pnpm", [
 		"turbo",
 		"run",
@@ -1749,7 +1486,7 @@ async function workspaceDevCommand(workspace, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down workspace...");
+		logger$10.log("\n🛑 Shutting down workspace...");
 		const pid = turboProcess.pid;
 		if (pid) try {
 			process.kill(-pid, "SIGTERM");
@@ -1771,14 +1508,14 @@ async function workspaceDevCommand(workspace, options) {
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
-	return new Promise((resolve$4, reject) => {
+	return new Promise((resolve$3, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$11.error("❌ Turbo error:", error);
+			logger$10.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
 			if (code !== null && code !== 0) reject(new Error(`Turbo exited with code ${code}`));
-			else resolve$4();
+			else resolve$3();
 		});
 	});
 }
@@ -1787,11 +1524,15 @@ async function buildServer(config, context, provider, enableOpenApi, appRoot = p
 	const functionGenerator = new FunctionGenerator();
 	const cronGenerator = new CronGenerator();
 	const subscriberGenerator = new SubscriberGenerator();
-	const [allEndpoints, allFunctions, allCrons, allSubscribers] = await Promise.all([
+	const queueGenerator = new QueueGenerator();
+	const topicGenerator = new TopicGenerator();
+	const [allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
 		endpointGenerator.load(config.routes, appRoot, bustCache),
 		config.functions ? functionGenerator.load(config.functions, appRoot, bustCache) : [],
 		config.crons ? cronGenerator.load(config.crons, appRoot, bustCache) : [],
-		config.subscribers ? subscriberGenerator.load(config.subscribers, appRoot, bustCache) : []
+		config.subscribers ? subscriberGenerator.load(config.subscribers, appRoot, bustCache) : [],
+		config.queues ? queueGenerator.load(config.queues, appRoot, bustCache) : [],
+		config.topics ? topicGenerator.load(config.topics, appRoot, bustCache) : []
 	]);
 	const outputDir = (0, node_path.join)(appRoot, ".gkm", provider);
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
@@ -1802,7 +1543,9 @@ async function buildServer(config, context, provider, enableOpenApi, appRoot = p
 		}),
 		functionGenerator.build(context, allFunctions, outputDir, { provider }),
 		cronGenerator.build(context, allCrons, outputDir, { provider }),
-		subscriberGenerator.build(context, allSubscribers, outputDir, { provider })
+		subscriberGenerator.build(context, allSubscribers, outputDir, { provider }),
+		queueGenerator.build(context, allQueues, outputDir, { provider }),
+		topicGenerator.build(context, allTopics, outputDir, { provider })
 	]);
 }
 /**
@@ -1814,23 +1557,23 @@ async function entryDevCommand(options) {
 	if (!entry) throw new Error("--entry requires a file path");
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
-	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$11.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$11.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$11.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	const defaultEnv = require_setup.loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_setup.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
+	if (appName) logger$10.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$10.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$10.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
-	await createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
+	await require_setup.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
 	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
 	await runner.start();
 	let isShuttingDown = false;
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$11.log("\n🛑 Shutting down...");
+		logger$10.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -1862,14 +1605,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$11.log(`📝 File changed: ${path}`);
+				logger$10.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$11.log("🔄 Restarting...");
+					logger$10.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$11.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$10.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -1884,22 +1627,22 @@ var EntryRunner = class {
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$11.error("❌ Process error:", error);
+			logger$10.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$10.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$4) => setTimeout(resolve$4, 500));
+		await new Promise((resolve$3) => setTimeout(resolve$3, 500));
 		if (this.isRunning) {
-			logger$11.log("");
-			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$11.log("");
+			logger$10.log("");
+			logger$10.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$10.log("");
 		}
 	}
 	async restart() {
 		this.stopProcess();
-		await new Promise((resolve$4) => setTimeout(resolve$4, 500));
+		await new Promise((resolve$3) => setTimeout(resolve$3, 500));
 		await this.runProcess();
 	}
 	stop() {
@@ -2003,16 +1746,16 @@ var DevServer = class {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
 		if (this.portExplicit) {
-			const available = await isPortAvailable(this.requestedPort);
+			const available = await require_setup.isPortAvailable(this.requestedPort);
 			if (!available) throw new Error(`Port ${this.requestedPort} is already in use. Either stop the process using that port or omit -p/--port to auto-select an available port.`);
 			this.actualPort = this.requestedPort;
 		} else {
-			this.actualPort = await findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$11.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			this.actualPort = await require_setup.findAvailablePort(this.requestedPort);
+			if (this.actualPort !== this.requestedPort) logger$10.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", this.provider, "server.ts");
 		await this.createServerEntry();
-		logger$11.log(`\n⏳ Starting server...`);
+		logger$10.log(`\n⏳ Starting server...`);
 		this.serverProcess = (0, node_child_process.spawn)("npx", [
 			"tsx",
 			serverEntryPath,
@@ -2028,13 +1771,13 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$11.error("❌ Server error:", error);
+			logger$10.error("❌ Server error:", error);
 		});
 		this.serverProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$10.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$4) => setTimeout(resolve$4, 1e3));
+		await new Promise((resolve$3) => setTimeout(resolve$3, 1e3));
 		if (this.isRunning) {
 			const base = `http://localhost:${this.actualPort}`;
 			const lines = [`  Local:     ${base}`];
@@ -2044,13 +1787,13 @@ var DevServer = class {
 			const maxLen = Math.max(...lines.map((l) => l.length));
 			const pad = (s) => s.padEnd(maxLen);
 			const border = "─".repeat(maxLen + 2);
-			logger$11.log("");
-			logger$11.log(`  \x1b[32m✓ Ready\x1b[0m in ${((Date.now() - this.startTime) / 1e3).toFixed(1)}s`);
-			logger$11.log("");
-			logger$11.log(`  ┌${border}┐`);
-			for (const line of lines) logger$11.log(`  │ ${pad(line)} │`);
-			logger$11.log(`  └${border}┘`);
-			logger$11.log("");
+			logger$10.log("");
+			logger$10.log(`  \x1b[32m✓ Ready\x1b[0m in ${((Date.now() - this.startTime) / 1e3).toFixed(1)}s`);
+			logger$10.log("");
+			logger$10.log(`  ┌${border}┐`);
+			for (const line of lines) logger$10.log(`  │ ${pad(line)} │`);
+			logger$10.log(`  └${border}┘`);
+			logger$10.log("");
 		}
 	}
 	async stop() {
@@ -2079,8 +1822,8 @@ var DevServer = class {
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
-			if (await isPortAvailable(portToReuse)) break;
-			await new Promise((resolve$4) => setTimeout(resolve$4, 100));
+			if (await require_setup.isPortAvailable(portToReuse)) break;
+			await new Promise((resolve$3) => setTimeout(resolve$3, 100));
 			attempts++;
 		}
 		this.requestedPort = portToReuse;
@@ -2100,7 +1843,7 @@ var DevServer = class {
 
 //#endregion
 //#region src/build/manifests.ts
-const logger$10 = console;
+const logger$9 = console;
 function isPartitioned(field) {
 	return !Array.isArray(field);
 }
@@ -2133,7 +1876,7 @@ function generateDerivedType(fieldName, typeName, partitioned) {
 	}
 	return `export type ${typeName} = (typeof manifest.${fieldName})[number];`;
 }
-async function generateAwsManifest(outputDir, routes, functions, crons, subscribers) {
+async function generateAwsManifest(outputDir, routes, functions, crons, subscribers, queues = [], topics = []) {
 	const manifestDir = (0, node_path.join)(outputDir, "manifest");
 	await (0, node_fs_promises.mkdir)(manifestDir, { recursive: true });
 	const awsRoutes = filterAllRoutes(routes);
@@ -2141,11 +1884,15 @@ async function generateAwsManifest(outputDir, routes, functions, crons, subscrib
 	const functionsPartitioned = isPartitioned(functions);
 	const cronsPartitioned = isPartitioned(crons);
 	const subscribersPartitioned = isPartitioned(subscribers);
+	const queuesPartitioned = isPartitioned(queues);
+	const topicsPartitioned = isPartitioned(topics);
 	const content = `export const manifest = {
   routes: ${serializeField(awsRoutes)},
   functions: ${serializeField(functions)},
   crons: ${serializeField(crons)},
   subscribers: ${serializeField(subscribers)},
+  queues: ${serializeField(queues)},
+  topics: ${serializeField(topics)},
 } as const;
 
 // Derived types
@@ -2153,6 +1900,8 @@ ${generateDerivedType("routes", "Route", routesPartitioned)}
 ${generateDerivedType("functions", "Function", functionsPartitioned)}
 ${generateDerivedType("crons", "Cron", cronsPartitioned)}
 ${generateDerivedType("subscribers", "Subscriber", subscribersPartitioned)}
+${generateDerivedType("queues", "Queue", queuesPartitioned)}
+${generateDerivedType("topics", "Topic", topicsPartitioned)}
 
 // Useful union types
 export type Authorizer = Route['authorizer'];
@@ -2161,25 +1910,33 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = (0, node_path.join)(manifestDir, "aws.ts");
 	await (0, node_fs_promises.writeFile)(manifestPath, content);
-	logger$10.log(`Generated AWS manifest with ${countItems(awsRoutes)} routes, ${countItems(functions)} functions, ${countItems(crons)} crons, ${countItems(subscribers)} subscribers`);
-	logger$10.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
+	logger$9.log(`Generated AWS manifest with ${countItems(awsRoutes)} routes, ${countItems(functions)} functions, ${countItems(crons)} crons, ${countItems(subscribers)} subscribers, ${countItems(queues)} queues, ${countItems(topics)} topics`);
+	logger$9.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
 }
-async function generateServerManifest(outputDir, appInfo, routes, subscribers) {
+async function generateServerManifest(outputDir, appInfo, routes, subscribers, queues = [], topics = []) {
 	const manifestDir = (0, node_path.join)(outputDir, "manifest");
 	await (0, node_fs_promises.mkdir)(manifestDir, { recursive: true });
 	const serverRoutes = mapRouteMetadata(filterAllRoutes(routes));
 	const serverSubscribers = mapSubscriberMetadata(subscribers);
+	const serverQueues = mapQueueMetadata(queues);
+	const serverTopics = mapTopicMetadata(topics);
 	const routesPartitioned = isPartitioned(serverRoutes);
 	const subscribersPartitioned = isPartitioned(serverSubscribers);
+	const queuesPartitioned = isPartitioned(serverQueues);
+	const topicsPartitioned = isPartitioned(serverTopics);
 	const content = `export const manifest = {
   app: ${JSON.stringify(appInfo, null, 2)},
   routes: ${serializeField(serverRoutes)},
   subscribers: ${serializeField(serverSubscribers)},
+  queues: ${serializeField(serverQueues)},
+  topics: ${serializeField(serverTopics)},
 } as const;
 
 // Derived types
 ${generateDerivedType("routes", "Route", routesPartitioned)}
 ${generateDerivedType("subscribers", "Subscriber", subscribersPartitioned)}
+${generateDerivedType("queues", "Queue", queuesPartitioned)}
+${generateDerivedType("topics", "Topic", topicsPartitioned)}
 
 // Useful union types
 export type Authorizer = Route['authorizer'];
@@ -2188,8 +1945,8 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = (0, node_path.join)(manifestDir, "server.ts");
 	await (0, node_fs_promises.writeFile)(manifestPath, content);
-	logger$10.log(`Generated server manifest with ${countItems(serverRoutes)} routes, ${countItems(serverSubscribers)} subscribers`);
-	logger$10.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
+	logger$9.log(`Generated server manifest with ${countItems(serverRoutes)} routes, ${countItems(serverSubscribers)} subscribers, ${countItems(serverQueues)} queues, ${countItems(serverTopics)} topics`);
+	logger$9.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
 }
 /**
 * Filter out 'ALL' method routes from a manifest field (flat or partitioned).
@@ -2227,6 +1984,23 @@ function mapSubscriberMetadata(subscribers) {
 	for (const [partition, partitionSubs] of Object.entries(subscribers)) result[partition] = partitionSubs.map(mapFn);
 	return result;
 }
+function mapQueueMetadata(queues) {
+	const mapFn = (q) => ({ name: q.name });
+	if (Array.isArray(queues)) return queues.map(mapFn);
+	const result = {};
+	for (const [partition, partitionQueues] of Object.entries(queues)) result[partition] = partitionQueues.map(mapFn);
+	return result;
+}
+function mapTopicMetadata(topics) {
+	const mapFn = (t) => ({
+		name: t.name,
+		events: t.events
+	});
+	if (Array.isArray(topics)) return topics.map(mapFn);
+	const result = {};
+	for (const [partition, partitionTopics] of Object.entries(topics)) result[partition] = partitionTopics.map(mapFn);
+	return result;
+}
 
 //#endregion
 //#region src/build/partitions.ts
@@ -2255,7 +2029,7 @@ function groupInfosByPartition(infos, constructs) {
 
 //#endregion
 //#region src/build/index.ts
-const logger$9 = console;
+const logger$8 = console;
 async function buildCommand(options) {
 	const loadedConfig = await require_config.loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
@@ -2263,7 +2037,7 @@ async function buildCommand(options) {
 		const workspaceRoot = (0, node_path.resolve)(loadedConfig.workspace.root);
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
 		if (isAtWorkspaceRoot) {
-			logger$9.log("📦 Detected workspace configuration");
+			logger$8.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
@@ -2271,21 +2045,21 @@ async function buildCommand(options) {
 	const resolved = resolveProviders(config, options);
 	const productionConfigFromGkm = getProductionConfigFromGkm(config);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
-	if (production) logger$9.log(`🏭 Building for PRODUCTION`);
-	logger$9.log(`Building with providers: ${resolved.providers.join(", ")}`);
-	logger$9.log(`Loading routes from: ${formatRoutes(config.routes)}`);
-	if (config.functions) logger$9.log(`Loading functions from: ${formatRoutes(config.functions)}`);
-	if (config.crons) logger$9.log(`Loading crons from: ${formatRoutes(config.crons)}`);
-	if (config.subscribers) logger$9.log(`Loading subscribers from: ${formatRoutes(config.subscribers)}`);
-	logger$9.log(`Using envParser: ${config.envParser}`);
+	if (production) logger$8.log(`🏭 Building for PRODUCTION`);
+	logger$8.log(`Building with providers: ${resolved.providers.join(", ")}`);
+	logger$8.log(`Loading routes from: ${formatRoutes(config.routes)}`);
+	if (config.functions) logger$8.log(`Loading functions from: ${formatRoutes(config.functions)}`);
+	if (config.crons) logger$8.log(`Loading crons from: ${formatRoutes(config.crons)}`);
+	if (config.subscribers) logger$8.log(`Loading subscribers from: ${formatRoutes(config.subscribers)}`);
+	logger$8.log(`Using envParser: ${config.envParser}`);
 	const { path: envParserPath, importPattern: envParserImportPattern } = require_config.parseModuleConfig(config.envParser, "envParser");
 	const { path: loggerPath, importPattern: loggerImportPattern } = require_config.parseModuleConfig(config.logger, "logger");
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$9.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$8.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = production ? void 0 : normalizeStudioConfig(config.studio);
-	if (studio) logger$9.log(`🗄️  Studio enabled at ${studio.path}`);
+	if (studio) logger$8.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks);
-	if (hooks) logger$9.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$8.log(`🪝 Server hooks enabled`);
 	const services = config.docker?.compose?.services;
 	const dockerServices = services ? Array.isArray(services) ? {
 		postgres: services.includes("postgres"),
@@ -2312,47 +2086,57 @@ async function buildCommand(options) {
 	const functionGenerator = new FunctionGenerator();
 	const cronGenerator = new CronGenerator();
 	const subscriberGenerator = new SubscriberGenerator();
-	const [allEndpoints, allFunctions, allCrons, allSubscribers] = await Promise.all([
+	const queueGenerator = new QueueGenerator();
+	const topicGenerator = new TopicGenerator();
+	const [allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
 		endpointGenerator.load(config.routes),
 		config.functions ? functionGenerator.load(config.functions) : [],
 		config.crons ? cronGenerator.load(config.crons) : [],
-		config.subscribers ? subscriberGenerator.load(config.subscribers) : []
+		config.subscribers ? subscriberGenerator.load(config.subscribers) : [],
+		config.queues ? queueGenerator.load(config.queues) : [],
+		config.topics ? topicGenerator.load(config.topics) : []
 	]);
-	logger$9.log(`Found ${allEndpoints.length} endpoints`);
-	logger$9.log(`Found ${allFunctions.length} functions`);
-	logger$9.log(`Found ${allCrons.length} crons`);
-	logger$9.log(`Found ${allSubscribers.length} subscribers`);
-	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0) {
-		logger$9.log("No endpoints, functions, crons, or subscribers found to process");
+	logger$8.log(`Found ${allEndpoints.length} endpoints`);
+	logger$8.log(`Found ${allFunctions.length} functions`);
+	logger$8.log(`Found ${allCrons.length} crons`);
+	logger$8.log(`Found ${allSubscribers.length} subscribers`);
+	logger$8.log(`Found ${allQueues.length} queues`);
+	logger$8.log(`Found ${allTopics.length} topics`);
+	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
+		logger$8.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
 	const rootOutputDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(rootOutputDir, { recursive: true });
 	let result = {};
 	for (const provider of resolved.providers) {
-		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
+		const providerResult = await buildForProvider(provider, buildContext, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, resolved.enableOpenApi, options.skipBundle ?? false, options.stage);
 		if (providerResult.masterKey) result = providerResult;
 	}
 	await require_openapi.generateOpenApi(config, { bustCache: true });
 	return result;
 }
-async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
+async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
 	const outputDir = (0, node_path.join)(process.cwd(), ".gkm", provider);
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
-	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
-	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
+	logger$8.log(`\nGenerating handlers for provider: ${provider}`);
+	const [routes, functionInfos, cronInfos, subscriberInfos, queueInfos, topicInfos] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
 			enableOpenApi
 		}),
 		functionGenerator.build(context, functions, outputDir, { provider }),
 		cronGenerator.build(context, crons, outputDir, { provider }),
-		subscriberGenerator.build(context, subscribers, outputDir, { provider })
+		subscriberGenerator.build(context, subscribers, outputDir, { provider }),
+		queueGenerator.build(context, queues, outputDir, { provider }),
+		topicGenerator.build(context, topics, outputDir, { provider })
 	]);
-	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
+	logger$8.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${provider}`);
 	const manifestRoutes = assembleManifestField(routes, endpoints);
 	const manifestFunctions = assembleManifestField(functionInfos, functions);
 	const manifestCrons = assembleManifestField(cronInfos, crons);
+	const manifestQueues = assembleManifestField(queueInfos, queues);
+	const manifestTopics = assembleManifestField(topicInfos, topics);
 	const manifestSubscribers = assembleManifestField(subscriberInfos, subscribers);
 	if (provider === "server") {
 		const routeMetadata = await Promise.all(endpoints.map(async ({ construct }) => ({
@@ -2366,16 +2150,17 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 			handler: (0, node_path.relative)(process.cwd(), (0, node_path.join)(outputDir, "app.ts")),
 			endpoints: (0, node_path.relative)(process.cwd(), (0, node_path.join)(outputDir, "endpoints.ts"))
 		};
-		await generateServerManifest(rootOutputDir, appInfo, serverRouteField, manifestSubscribers);
+		await generateServerManifest(rootOutputDir, appInfo, serverRouteField, manifestSubscribers, manifestQueues, manifestTopics);
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
-			logger$9.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BG6P249p.cjs"));
+			logger$8.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dufq3uvI.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
 				...crons.map((c) => c.construct),
-				...subscribers.map((s) => s.construct)
+				...subscribers.map((s) => s.construct),
+				...queues.map((q) => q.construct)
 			];
 			const dockerServices = context.dockerServices;
 			const bundleResult = await bundleServer({
@@ -2389,14 +2174,14 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 				dockerServices
 			});
 			masterKey = bundleResult.masterKey;
-			logger$9.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$8.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
-				logger$9.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$9.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
+				logger$8.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$8.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
 			}
 		}
 		return { masterKey };
-	} else await generateAwsManifest(rootOutputDir, manifestRoutes, manifestFunctions, manifestCrons, manifestSubscribers);
+	} else await generateAwsManifest(rootOutputDir, manifestRoutes, manifestFunctions, manifestCrons, manifestSubscribers, manifestQueues, manifestTopics);
 	return {};
 }
 /**
@@ -2429,18 +2214,18 @@ async function workspaceBuildCommand(workspace, options) {
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
 	const frontendApps = apps.filter(([, app]) => app.type === "web");
-	logger$9.log(`\n🏗️  Building workspace: ${workspace.name}`);
-	logger$9.log(`   Backend apps: ${backendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
-	logger$9.log(`   Frontend apps: ${frontendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
-	if (options.production) logger$9.log(`   🏭 Production mode enabled`);
+	logger$8.log(`\n🏗️  Building workspace: ${workspace.name}`);
+	logger$8.log(`   Backend apps: ${backendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
+	logger$8.log(`   Frontend apps: ${frontendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
+	if (options.production) logger$8.log(`   🏭 Production mode enabled`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	logger$9.log(`   Build order: ${buildOrder.join(" → ")}`);
+	logger$8.log(`   Build order: ${buildOrder.join(" → ")}`);
 	const pm = detectPackageManager$2();
-	logger$9.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
+	logger$8.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
 	try {
 		const turboCommand = getTurboCommand(pm);
-		logger$9.log(`Running: ${turboCommand}`);
-		await new Promise((resolve$4, reject) => {
+		logger$8.log(`Running: ${turboCommand}`);
+		await new Promise((resolve$3, reject) => {
 			const child = (0, node_child_process.spawn)(turboCommand, {
 				shell: true,
 				cwd: workspace.root,
@@ -2451,7 +2236,7 @@ async function workspaceBuildCommand(workspace, options) {
 				}
 			});
 			child.on("close", (code) => {
-				if (code === 0) resolve$4();
+				if (code === 0) resolve$3();
 				else reject(new Error(`Turbo build failed with exit code ${code}`));
 			});
 			child.on("error", (err) => {
@@ -2467,16 +2252,16 @@ async function workspaceBuildCommand(workspace, options) {
 				outputPath
 			});
 		}
-		logger$9.log(`\n✅ Workspace build complete!`);
+		logger$8.log(`\n✅ Workspace build complete!`);
 		await require_openapi.openapiCommand({ cwd: workspace.root });
-		logger$9.log(`\n📋 Build Summary:`);
+		logger$8.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-			logger$9.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
+			logger$8.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : "Build failed";
-		logger$9.log(`\n❌ Build failed: ${errorMessage}`);
+		logger$8.log(`\n❌ Build failed: ${errorMessage}`);
 		for (const [appName, app] of apps) results.push({
 			appName,
 			type: app.type,
@@ -2703,11 +2488,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-5KYmwoK2.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-CrHfsgz9.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-owQQ4pn6.cjs"));
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-DwgXiLxt.cjs"));
 		const route53Config = config;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -2721,7 +2506,7 @@ async function createDnsProvider(options) {
 
 //#endregion
 //#region src/deploy/dns/index.ts
-const logger$8 = console;
+const logger$7 = console;
 /**
 * Check if DNS config is legacy format (single domain with `domain` property)
 */
@@ -2758,7 +2543,7 @@ function groupHostnamesByDomain(appHostnames, dnsConfig) {
 	for (const [appName, hostname] of appHostnames) {
 		const rootDomain = findRootDomain(hostname, dnsConfig);
 		if (!rootDomain) {
-			logger$8.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			logger$7.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
 			continue;
 		}
 		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
@@ -2810,10 +2595,10 @@ function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
 * Print DNS records table
 */
 function printDnsRecordsTable(records, rootDomain) {
-	logger$8.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$8.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$8.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$8.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	logger$7.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$7.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$7.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$7.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
 	for (const record of records) {
 		const subdomain = record.subdomain.padEnd(35);
 		const type$1 = record.type.padEnd(4);
@@ -2823,18 +2608,18 @@ function printDnsRecordsTable(records, rootDomain) {
 		else if (record.created) status = "✓ new";
 		else if (record.existed) status = "✓";
 		else status = "?";
-		logger$8.log(`   │ ${subdomain} │ ${type$1} │ ${value} │ ${status.padEnd(6)} │`);
+		logger$7.log(`   │ ${subdomain} │ ${type$1} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	logger$8.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+	logger$7.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
 * Print DNS records in a simple format for manual setup
 */
 function printDnsRecordsSimple(records, rootDomain) {
-	logger$8.log("\n   📋 Required DNS Records:");
-	logger$8.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$8.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$8.log("");
+	logger$7.log("\n   📋 Required DNS Records:");
+	logger$7.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$7.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$7.log("");
 }
 /**
 * Create DNS records for a single domain using its configured provider
@@ -2846,7 +2631,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		provider = await createDnsProvider({ config: providerConfig });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$8.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		logger$7.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			...r,
 			error: message
@@ -2900,7 +2685,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$8.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		logger$7.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			hostname: r.hostname,
 			subdomain: r.subdomain,
@@ -2927,20 +2712,20 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$8.log("\n🌐 Setting up DNS records...");
+	logger$7.log("\n🌐 Setting up DNS records...");
 	let serverIp;
 	try {
 		const endpointUrl = new URL(dokployEndpoint);
 		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$8.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+		logger$7.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$8.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		logger$7.log(`   ⚠ Failed to resolve server IP: ${message}`);
 		return null;
 	}
 	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
 	if (groupedHostnames.size === 0) {
-		logger$8.log("   No DNS records needed (no hostnames match configured domains)");
+		logger$7.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
 			records: [],
 			success: true,
@@ -2952,22 +2737,22 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	for (const [rootDomain, domainHostnames] of groupedHostnames) {
 		const providerConfig = normalizedConfig[rootDomain];
 		if (!providerConfig) {
-			logger$8.log(`   ⚠ No provider config for ${rootDomain}`);
+			logger$7.log(`   ⚠ No provider config for ${rootDomain}`);
 			continue;
 		}
 		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
 		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
 		if (requiredRecords.length === 0) continue;
-		logger$8.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		logger$7.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
 		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
 		allRecords.push(...domainRecords);
 		const created = domainRecords.filter((r) => r.created).length;
 		const existed = domainRecords.filter((r) => r.existed).length;
 		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$8.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$8.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (created > 0) logger$7.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$7.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
 		if (failed > 0) {
-			logger$8.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			logger$7.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
 		if (state) {
@@ -3004,10 +2789,10 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 */
 async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
-	logger$8.log("\n🔍 Verifying DNS records...");
+	logger$7.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
 		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$8.log(`   ✓ ${hostname} (previously verified)`);
+			logger$7.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
 				appName,
@@ -3021,7 +2806,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
 				setDnsVerification(state, hostname, serverIp);
-				logger$8.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				logger$7.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -3030,7 +2815,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 					expectedIp: serverIp
 				});
 			} else {
-				logger$8.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				logger$7.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -3041,7 +2826,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$8.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			logger$7.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
 			results.push({
 				hostname,
 				appName,
@@ -3055,9 +2840,9 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const skipped = results.filter((r) => r.skipped).length;
 	const pending = results.filter((r) => !r.verified).length;
 	if (pending > 0) {
-		logger$8.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$8.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$8.log(`   ${verified} verified (${skipped} from cache)`);
+		logger$7.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$7.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$7.log(`   ${verified} verified (${skipped} from cache)`);
 	return results;
 }
 
@@ -4528,7 +4313,7 @@ CMD ["nginx", "-g", "daemon off;"]
 
 //#endregion
 //#region src/docker/index.ts
-const logger$7 = console;
+const logger$6 = console;
 /**
 * Docker command implementation
 * Generates Dockerfile, docker-compose.yml, and related files
@@ -4539,7 +4324,7 @@ const logger$7 = console;
 async function dockerCommand(options) {
 	const loadedConfig = await require_config.loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$7.log("📦 Detected workspace configuration");
+		logger$6.log("📦 Detected workspace configuration");
 		return workspaceDockerCommand(loadedConfig.workspace, options);
 	}
 	const config = await require_config.loadConfig();
@@ -4560,14 +4345,14 @@ async function dockerCommand(options) {
 	let useTurbo = options.turbo ?? false;
 	if (inMonorepo && !useSlim) if (hasTurbo) {
 		useTurbo = true;
-		logger$7.log("   Detected monorepo with turbo.json - using turbo prune");
+		logger$6.log("   Detected monorepo with turbo.json - using turbo prune");
 	} else throw new Error("Monorepo detected but turbo.json not found.\n\nDocker builds in monorepos require Turborepo for proper dependency isolation.\n\nTo fix this:\n  1. Install turbo: pnpm add -Dw turbo\n  2. Create turbo.json in your monorepo root\n  3. Run this command again\n\nSee: https://turbo.build/repo/docs/guides/tools/docker");
 	let turboPackage = options.turboPackage ?? dockerConfig.imageName;
 	if (useTurbo && !options.turboPackage) try {
 		const pkg$1 = require(`${process.cwd()}/package.json`);
 		if (pkg$1.name) {
 			turboPackage = pkg$1.name;
-			logger$7.log(`   Turbo package: ${turboPackage}`);
+			logger$6.log(`   Turbo package: ${turboPackage}`);
 		}
 	} catch {}
 	const templateOptions = {
@@ -4584,7 +4369,7 @@ async function dockerCommand(options) {
 	const dockerMode = useSlim ? "slim" : useTurbo ? "turbo" : "multi-stage";
 	const dockerfilePath = (0, node_path.join)(dockerDir, "Dockerfile");
 	await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-	logger$7.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
+	logger$6.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
 	const composeOptions = {
 		imageName: dockerConfig.imageName,
 		registry: options.registry ?? dockerConfig.registry,
@@ -4596,15 +4381,15 @@ async function dockerCommand(options) {
 	const dockerCompose = hasServices ? generateDockerCompose(composeOptions) : generateMinimalDockerCompose(composeOptions);
 	const composePath = (0, node_path.join)(dockerDir, "docker-compose.yml");
 	await (0, node_fs_promises.writeFile)(composePath, dockerCompose);
-	logger$7.log("Generated: .gkm/docker/docker-compose.yml");
+	logger$6.log("Generated: .gkm/docker/docker-compose.yml");
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = (0, node_path.join)(process.cwd(), ".dockerignore");
 	await (0, node_fs_promises.writeFile)(dockerignorePath, dockerignore);
-	logger$7.log("Generated: .dockerignore (project root)");
+	logger$6.log("Generated: .dockerignore (project root)");
 	const entrypoint = generateDockerEntrypoint();
 	const entrypointPath = (0, node_path.join)(dockerDir, "docker-entrypoint.sh");
 	await (0, node_fs_promises.writeFile)(entrypointPath, entrypoint);
-	logger$7.log("Generated: .gkm/docker/docker-entrypoint.sh");
+	logger$6.log("Generated: .gkm/docker/docker-entrypoint.sh");
 	const result = {
 		dockerfile: dockerfilePath,
 		dockerCompose: composePath,
@@ -4623,13 +4408,13 @@ async function dockerCommand(options) {
 function ensureLockfile(cwd) {
 	const lockfilePath = findLockfilePath(cwd);
 	if (!lockfilePath) {
-		logger$7.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
+		logger$6.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
 		return null;
 	}
 	const lockfileName = (0, node_path.basename)(lockfilePath);
 	const localLockfile = (0, node_path.join)(cwd, lockfileName);
 	if (lockfilePath === localLockfile) return null;
-	logger$7.log(`   Copying ${lockfileName} from monorepo root...`);
+	logger$6.log(`   Copying ${lockfileName} from monorepo root...`);
 	(0, node_fs.copyFileSync)(lockfilePath, localLockfile);
 	return () => {
 		try {
@@ -4645,7 +4430,7 @@ async function buildDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
-	logger$7.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger$6.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cwd = process.cwd();
 	const cleanup = ensureLockfile(cwd);
 	try {
@@ -4657,7 +4442,7 @@ async function buildDockerImage(imageName, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$7.log(`✅ Docker image built: ${fullImageName}`);
+		logger$6.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	} finally {
@@ -4672,13 +4457,13 @@ async function pushDockerImage(imageName, options) {
 	const registry = options.registry;
 	if (!registry) throw new Error("Registry is required to push Docker image. Use --registry or configure docker.registry in gkm.config.ts");
 	const fullImageName = `${registry}/${imageName}:${tag}`;
-	logger$7.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger$6.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		(0, node_child_process.execSync)(`docker push ${fullImageName}`, {
 			cwd: process.cwd(),
 			stdio: "inherit"
 		});
-		logger$7.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger$6.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -4704,14 +4489,14 @@ function getAppPackageName(appPath) {
 async function workspaceDockerCommand(workspace, options) {
 	const results = [];
 	const apps = Object.entries(workspace.apps);
-	logger$7.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger$6.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
 	const dockerDir = (0, node_path.join)(workspace.root, ".gkm", "docker");
 	await (0, node_fs_promises.mkdir)(dockerDir, { recursive: true });
 	const packageManager = detectPackageManager$1(workspace.root);
-	logger$7.log(`   Package manager: ${packageManager}`);
+	logger$6.log(`   Package manager: ${packageManager}`);
 	for (const [appName, app] of apps) {
 		if (app.type === "mobile") {
-			logger$7.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger$6.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
 		const appPath = app.path;
@@ -4720,7 +4505,7 @@ async function workspaceDockerCommand(workspace, options) {
 		const imageName = appName;
 		const hasEntry = !!app.entry;
 		const buildType = hasEntry ? "entry" : app.type;
-		logger$7.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger$6.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		let dockerfile;
 		if (app.type === "web") {
 			const publicUrlArgs = getPublicUrlArgNames(app);
@@ -4764,7 +4549,7 @@ async function workspaceDockerCommand(workspace, options) {
 		});
 		const dockerfilePath = (0, node_path.join)(dockerDir, `Dockerfile.${appName}`);
 		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-		logger$7.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
+		logger$6.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -4775,19 +4560,19 @@ async function workspaceDockerCommand(workspace, options) {
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = (0, node_path.join)(workspace.root, ".dockerignore");
 	await (0, node_fs_promises.writeFile)(dockerignorePath, dockerignore);
-	logger$7.log(`\n   Generated: .dockerignore (workspace root)`);
+	logger$6.log(`\n   Generated: .dockerignore (workspace root)`);
 	const dockerCompose = generateWorkspaceCompose(workspace, { registry: options.registry });
 	const composePath = (0, node_path.join)(dockerDir, "docker-compose.yml");
 	await (0, node_fs_promises.writeFile)(composePath, dockerCompose);
-	logger$7.log(`   Generated: .gkm/docker/docker-compose.yml`);
-	logger$7.log(`\n✅ Generated ${results.length} Dockerfile(s) + docker-compose.yml`);
-	logger$7.log("\n📋 Build commands:");
+	logger$6.log(`   Generated: .gkm/docker/docker-compose.yml`);
+	logger$6.log(`\n✅ Generated ${results.length} Dockerfile(s) + docker-compose.yml`);
+	logger$6.log("\n📋 Build commands:");
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger$7.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
+		logger$6.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
 	}
-	logger$7.log("\n📋 Run all services:");
-	logger$7.log("   docker compose -f .gkm/docker/docker-compose.yml up --build");
+	logger$6.log("\n📋 Run all services:");
+	logger$6.log("   docker compose -f .gkm/docker/docker-compose.yml up --build");
 	return {
 		apps: results,
 		dockerCompose: composePath,
@@ -4827,7 +4612,7 @@ function getAppNameFromPackageJson() {
 	} catch {}
 	return void 0;
 }
-const logger$6 = console;
+const logger$5 = console;
 /**
 * Get the full image reference
 */
@@ -4842,18 +4627,18 @@ function getImageRef(registry, imageName, tag) {
 * @param buildArgs - Build arguments to pass to docker build
 */
 async function buildImage(imageRef, appName, buildArgs) {
-	logger$6.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$5.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
 	const lockfilePath = findLockfilePath(cwd);
 	const lockfileDir = lockfilePath ? (0, node_path.dirname)(lockfilePath) : cwd;
 	const inMonorepo = lockfileDir !== cwd;
-	if (appName || inMonorepo) logger$6.log("   Generating Dockerfile for monorepo (turbo prune)...");
-	else logger$6.log("   Generating Dockerfile...");
+	if (appName || inMonorepo) logger$5.log("   Generating Dockerfile for monorepo (turbo prune)...");
+	else logger$5.log("   Generating Dockerfile...");
 	await dockerCommand({});
 	const dockerfileSuffix = appName ? `.${appName}` : "";
 	const dockerfilePath = `.gkm/docker/Dockerfile${dockerfileSuffix}`;
 	const buildCwd = lockfilePath && (inMonorepo || appName) ? lockfileDir : cwd;
-	if (buildCwd !== cwd) logger$6.log(`   Building from workspace root: ${buildCwd}`);
+	if (buildCwd !== cwd) logger$5.log(`   Building from workspace root: ${buildCwd}`);
 	const buildArgsString = buildArgs && buildArgs.length > 0 ? buildArgs.map((arg) => `--build-arg "${arg}"`).join(" ") : "";
 	try {
 		const cmd = [
@@ -4872,7 +4657,7 @@ async function buildImage(imageRef, appName, buildArgs) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$6.log(`✅ Image built: ${imageRef}`);
+		logger$5.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
 		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -4881,13 +4666,13 @@ async function buildImage(imageRef, appName, buildArgs) {
 * Push Docker image to registry
 */
 async function pushImage(imageRef) {
-	logger$6.log(`\n☁️  Pushing image: ${imageRef}`);
+	logger$5.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
 		(0, node_child_process.execSync)(`docker push ${imageRef}`, {
 			cwd: process.cwd(),
 			stdio: "inherit"
 		});
-		logger$6.log(`✅ Image pushed: ${imageRef}`);
+		logger$5.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
 		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -4900,17 +4685,17 @@ async function deployDocker(options) {
 	const imageName = config.imageName;
 	const imageRef = getImageRef(config.registry, imageName, tag);
 	await buildImage(imageRef, config.appName, buildArgs);
-	if (!skipPush) if (!config.registry) logger$6.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+	if (!skipPush) if (!config.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 	else await pushImage(imageRef);
-	logger$6.log("\n✅ Docker deployment ready!");
-	logger$6.log(`\n📋 Deployment details:`);
-	logger$6.log(`   Image: ${imageRef}`);
-	logger$6.log(`   Stage: ${stage}`);
+	logger$5.log("\n✅ Docker deployment ready!");
+	logger$5.log(`\n📋 Deployment details:`);
+	logger$5.log(`   Image: ${imageRef}`);
+	logger$5.log(`   Stage: ${stage}`);
 	if (masterKey) {
-		logger$6.log(`\n🔐 Deploy with this environment variable:`);
-		logger$6.log(`   GKM_MASTER_KEY=${masterKey}`);
-		logger$6.log("\n   Example docker run:");
-		logger$6.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
+		logger$5.log(`\n🔐 Deploy with this environment variable:`);
+		logger$5.log(`   GKM_MASTER_KEY=${masterKey}`);
+		logger$5.log("\n   Example docker run:");
+		logger$5.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
 	}
 	return {
 		imageRef,
@@ -4937,7 +4722,7 @@ function resolveDockerConfig(config) {
 
 //#endregion
 //#region src/deploy/dokploy.ts
-const logger$5 = console;
+const logger$4 = console;
 /**
 * Get the Dokploy API token from stored credentials or environment
 */
@@ -4961,25 +4746,25 @@ async function createApi$1(endpoint) {
 */
 async function deployDokploy(options) {
 	const { stage, imageRef, masterKey, config } = options;
-	logger$5.log(`\n🎯 Deploying to Dokploy...`);
-	logger$5.log(`   Endpoint: ${config.endpoint}`);
-	logger$5.log(`   Application: ${config.applicationId}`);
+	logger$4.log(`\n🎯 Deploying to Dokploy...`);
+	logger$4.log(`   Endpoint: ${config.endpoint}`);
+	logger$4.log(`   Application: ${config.applicationId}`);
 	const api = await createApi$1(config.endpoint);
-	logger$5.log(`  Configuring Docker image: ${imageRef}`);
+	logger$4.log(`  Configuring Docker image: ${imageRef}`);
 	const registryOptions = {};
 	if (config.registryId) {
 		registryOptions.registryId = config.registryId;
-		logger$5.log(`  Using Dokploy registry: ${config.registryId}`);
+		logger$4.log(`  Using Dokploy registry: ${config.registryId}`);
 	} else {
 		const storedRegistryId = await require_credentials.getDokployRegistryId();
 		if (storedRegistryId) {
 			registryOptions.registryId = storedRegistryId;
-			logger$5.log(`  Using stored Dokploy registry: ${storedRegistryId}`);
+			logger$4.log(`  Using stored Dokploy registry: ${storedRegistryId}`);
 		} else if (config.registryCredentials) {
 			registryOptions.username = config.registryCredentials.username;
 			registryOptions.password = config.registryCredentials.password;
 			registryOptions.registryUrl = config.registryCredentials.registryUrl;
-			logger$5.log(`  Using registry credentials for: ${config.registryCredentials.registryUrl}`);
+			logger$4.log(`  Using registry credentials for: ${config.registryCredentials.registryUrl}`);
 		} else {
 			const username = process.env.DOCKER_REGISTRY_USERNAME;
 			const password = process.env.DOCKER_REGISTRY_PASSWORD;
@@ -4988,31 +4773,31 @@ async function deployDokploy(options) {
 				registryOptions.username = username;
 				registryOptions.password = password;
 				registryOptions.registryUrl = registryUrl;
-				logger$5.log(`  Using registry credentials from environment`);
+				logger$4.log(`  Using registry credentials from environment`);
 			}
 		}
 	}
 	await api.saveDockerProvider(config.applicationId, imageRef, registryOptions);
-	logger$5.log("  ✓ Docker provider configured");
+	logger$4.log("  ✓ Docker provider configured");
 	const envVars = {};
 	if (masterKey) envVars.GKM_MASTER_KEY = masterKey;
 	if (Object.keys(envVars).length > 0) {
-		logger$5.log("  Updating environment variables...");
+		logger$4.log("  Updating environment variables...");
 		const envString = Object.entries(envVars).map(([key, value]) => `${key}=${value}`).join("\n");
 		await api.saveApplicationEnv(config.applicationId, envString);
-		logger$5.log("  ✓ Environment variables updated");
+		logger$4.log("  ✓ Environment variables updated");
 	}
-	logger$5.log("  Triggering deployment...");
+	logger$4.log("  Triggering deployment...");
 	await api.deployApplication(config.applicationId);
-	logger$5.log("  ✓ Deployment triggered");
-	logger$5.log("\n✅ Dokploy deployment initiated!");
-	logger$5.log(`\n📋 Deployment details:`);
-	logger$5.log(`   Image: ${imageRef}`);
-	logger$5.log(`   Stage: ${stage}`);
-	logger$5.log(`   Application ID: ${config.applicationId}`);
-	if (masterKey) logger$5.log(`\n🔐 GKM_MASTER_KEY has been set in Dokploy environment`);
+	logger$4.log("  ✓ Deployment triggered");
+	logger$4.log("\n✅ Dokploy deployment initiated!");
+	logger$4.log(`\n📋 Deployment details:`);
+	logger$4.log(`   Image: ${imageRef}`);
+	logger$4.log(`   Stage: ${stage}`);
+	logger$4.log(`   Application ID: ${config.applicationId}`);
+	if (masterKey) logger$4.log(`\n🔐 GKM_MASTER_KEY has been set in Dokploy environment`);
 	const deploymentUrl = `${config.endpoint}/project/${config.projectId}`;
-	logger$5.log(`\n🔗 View deployment: ${deploymentUrl}`);
+	logger$4.log(`\n🔗 View deployment: ${deploymentUrl}`);
 	return {
 		imageRef,
 		masterKey,
@@ -5129,7 +4914,7 @@ function validateEnvVars(requiredVars, context) {
 
 //#endregion
 //#region src/deploy/init.ts
-const logger$4 = console;
+const logger$3 = console;
 /**
 * Get the Dokploy API token from stored credentials or environment
 */
@@ -5163,20 +4948,20 @@ async function createApi(endpoint) {
 async function updateConfig(config, cwd = process.cwd()) {
 	const configPath = (0, node_path.join)(cwd, "gkm.config.ts");
 	if (!(0, node_fs.existsSync)(configPath)) {
-		logger$4.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
-		logger$4.log(`  providers: {`);
-		logger$4.log(`    dokploy: {`);
-		logger$4.log(`      endpoint: '${config.endpoint}',`);
-		logger$4.log(`      projectId: '${config.projectId}',`);
-		logger$4.log(`      applicationId: '${config.applicationId}',`);
-		logger$4.log(`    },`);
-		logger$4.log(`  },`);
+		logger$3.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
+		logger$3.log(`  providers: {`);
+		logger$3.log(`    dokploy: {`);
+		logger$3.log(`      endpoint: '${config.endpoint}',`);
+		logger$3.log(`      projectId: '${config.projectId}',`);
+		logger$3.log(`      applicationId: '${config.applicationId}',`);
+		logger$3.log(`    },`);
+		logger$3.log(`  },`);
 		return;
 	}
 	const content = await (0, node_fs_promises.readFile)(configPath, "utf-8");
 	if (content.includes("dokploy:") && content.includes("applicationId:")) {
-		logger$4.log("\n  Dokploy config already exists in gkm.config.ts");
-		logger$4.log("  Updating with new values...");
+		logger$3.log("\n  Dokploy config already exists in gkm.config.ts");
+		logger$3.log("  Updating with new values...");
 	}
 	const registryLine = config.registryId ? `\n\t\t\tregistryId: '${config.registryId}',` : "";
 	const dokployConfigStr = `dokploy: {
@@ -5193,7 +4978,7 @@ async function updateConfig(config, cwd = process.cwd()) {
 	},
 });`);
 	await (0, node_fs_promises.writeFile)(configPath, newContent);
-	logger$4.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
+	logger$3.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
 }
 /**
 * Initialize Dokploy deployment configuration
@@ -5202,24 +4987,24 @@ async function deployInitCommand(options) {
 	const { projectName, appName, projectId: existingProjectId, registryId } = options;
 	const endpoint = await getEndpoint(options.endpoint);
 	const api = await createApi(endpoint);
-	logger$4.log(`\n🚀 Initializing Dokploy deployment...`);
-	logger$4.log(`   Endpoint: ${endpoint}`);
+	logger$3.log(`\n🚀 Initializing Dokploy deployment...`);
+	logger$3.log(`   Endpoint: ${endpoint}`);
 	let projectId;
 	if (existingProjectId) {
 		projectId = existingProjectId;
-		logger$4.log(`\n📁 Using existing project: ${projectId}`);
+		logger$3.log(`\n📁 Using existing project: ${projectId}`);
 	} else {
-		logger$4.log(`\n📁 Looking for project: ${projectName}`);
+		logger$3.log(`\n📁 Looking for project: ${projectName}`);
 		const projects = await api.listProjects();
 		const existingProject = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 		if (existingProject) {
 			projectId = existingProject.projectId;
-			logger$4.log(`   Found existing project: ${projectId}`);
+			logger$3.log(`   Found existing project: ${projectId}`);
 		} else {
-			logger$4.log(`   Creating new project...`);
+			logger$3.log(`   Creating new project...`);
 			const result = await api.createProject(projectName);
 			projectId = result.project.projectId;
-			logger$4.log(`   ✓ Created project: ${projectId}`);
+			logger$3.log(`   ✓ Created project: ${projectId}`);
 		}
 	}
 	const project = await api.getProject(projectId);
@@ -5227,23 +5012,23 @@ async function deployInitCommand(options) {
 	const firstEnv = project.environments?.[0];
 	if (firstEnv) environmentId = firstEnv.environmentId;
 	else {
-		logger$4.log(`   Creating production environment...`);
+		logger$3.log(`   Creating production environment...`);
 		const env = await api.createEnvironment(projectId, "production");
 		environmentId = env.environmentId;
 	}
-	logger$4.log(`\n📦 Creating application: ${appName}`);
+	logger$3.log(`\n📦 Creating application: ${appName}`);
 	const application = await api.createApplication(appName, projectId, environmentId);
-	logger$4.log(`   ✓ Created application: ${application.applicationId}`);
+	logger$3.log(`   ✓ Created application: ${application.applicationId}`);
 	if (registryId) {
-		logger$4.log(`\n🔧 Configuring registry: ${registryId}`);
+		logger$3.log(`\n🔧 Configuring registry: ${registryId}`);
 		await api.updateApplication(application.applicationId, { registryId });
-		logger$4.log(`   ✓ Registry configured`);
+		logger$3.log(`   ✓ Registry configured`);
 	} else try {
 		const registries = await api.listRegistries();
 		if (registries.length > 0) {
-			logger$4.log(`\n📋 Available registries:`);
-			for (const reg of registries) logger$4.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
-			logger$4.log(`\n   To use a registry, run with --registry-id <id>`);
+			logger$3.log(`\n📋 Available registries:`);
+			for (const reg of registries) logger$3.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
+			logger$3.log(`\n   To use a registry, run with --registry-id <id>`);
 		}
 	} catch {}
 	const config = {
@@ -5252,14 +5037,14 @@ async function deployInitCommand(options) {
 		applicationId: application.applicationId
 	};
 	await updateConfig(config);
-	logger$4.log(`\n✅ Dokploy deployment initialized!`);
-	logger$4.log(`\n📋 Configuration:`);
-	logger$4.log(`   Project ID: ${projectId}`);
-	logger$4.log(`   Application ID: ${application.applicationId}`);
-	logger$4.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
-	logger$4.log(`\n📝 Next steps:`);
-	logger$4.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
-	logger$4.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
+	logger$3.log(`\n✅ Dokploy deployment initialized!`);
+	logger$3.log(`\n📋 Configuration:`);
+	logger$3.log(`   Project ID: ${projectId}`);
+	logger$3.log(`   Application ID: ${application.applicationId}`);
+	logger$3.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
+	logger$3.log(`\n📝 Next steps:`);
+	logger$3.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
+	logger$3.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
 	return config;
 }
 /**
@@ -5270,32 +5055,32 @@ async function deployListCommand(options) {
 	const api = await createApi(endpoint);
 	const { resource } = options;
 	if (resource === "projects") {
-		logger$4.log(`\n📁 Projects in ${endpoint}:`);
+		logger$3.log(`\n📁 Projects in ${endpoint}:`);
 		const projects = await api.listProjects();
 		if (projects.length === 0) {
-			logger$4.log("   No projects found");
+			logger$3.log("   No projects found");
 			return;
 		}
 		for (const project of projects) {
-			logger$4.log(`\n   ${project.name} (${project.projectId})`);
-			if (project.description) logger$4.log(`     ${project.description}`);
+			logger$3.log(`\n   ${project.name} (${project.projectId})`);
+			if (project.description) logger$3.log(`     ${project.description}`);
 		}
 	} else if (resource === "registries") {
-		logger$4.log(`\n🐳 Registries in ${endpoint}:`);
+		logger$3.log(`\n🐳 Registries in ${endpoint}:`);
 		const registries = await api.listRegistries();
 		if (registries.length === 0) {
-			logger$4.log("   No registries configured");
-			logger$4.log("   Run \"gkm registry:setup\" to configure a registry");
+			logger$3.log("   No registries configured");
+			logger$3.log("   Run \"gkm registry:setup\" to configure a registry");
 			return;
 		}
 		const storedRegistryId = await require_credentials.getDokployRegistryId();
 		for (const registry of registries) {
 			const isDefault = registry.registryId === storedRegistryId;
 			const marker = isDefault ? " (default)" : "";
-			logger$4.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
-			logger$4.log(`     URL: ${registry.registryUrl}`);
-			logger$4.log(`     Username: ${registry.username}`);
-			if (registry.imagePrefix) logger$4.log(`     Prefix: ${registry.imagePrefix}`);
+			logger$3.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
+			logger$3.log(`     URL: ${registry.registryUrl}`);
+			logger$3.log(`     Username: ${registry.username}`);
+			if (registry.imagePrefix) logger$3.log(`     Prefix: ${registry.imagePrefix}`);
 		}
 	}
 }
@@ -5318,20 +5103,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config) {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CalzNfNA.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CalzNfNA.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CLifRC0Y.cjs"));
-		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-CT8tjl9o.cjs"));
-		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-37pG1HBx.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-CalzNfNA.cjs"));
+		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-Bt6r8CTL.cjs"));
+		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-BdX7klRc.cjs"));
 		const ssmConfig = config;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -5791,7 +5576,7 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 
 //#endregion
 //#region src/deploy/index.ts
-const logger$3 = console;
+const logger$2 = console;
 /**
 * Prompt for input
 */
@@ -5799,7 +5584,7 @@ async function prompt(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please configure manually.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$4) => {
+		return new Promise((resolve$3) => {
 			let value = "";
 			const onData = (char) => {
 				const c = char.toString();
@@ -5808,7 +5593,7 @@ async function prompt(message, hidden = false) {
 					process.stdin.pause();
 					process.stdin.removeListener("data", onData);
 					process.stdout.write("\n");
-					resolve$4(value);
+					resolve$3(value);
 				} else if (c === "") {
 					process.stdin.setRawMode(false);
 					process.stdin.pause();
@@ -5863,7 +5648,7 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 		return;
 	} catch {
 		if (i < maxRetries - 1) {
-			logger$3.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			logger$2.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
 			await new Promise((r) => setTimeout(r, retryIntervalMs));
 		}
 	}
@@ -5898,12 +5683,12 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 * ```
 */
 async function initializePostgresUsers(api, postgres, serverHostname, users) {
-	logger$3.log("\n🔧 Initializing database users...");
+	logger$2.log("\n🔧 Initializing database users...");
 	const externalPort = 5432;
-	logger$3.log(`   Enabling external port ${externalPort}...`);
+	logger$2.log(`   Enabling external port ${externalPort}...`);
 	await api.savePostgresExternalPort(postgres.postgresId, externalPort);
 	await api.deployPostgres(postgres.postgresId);
-	logger$3.log(`   Waiting for Postgres to be accessible at ${serverHostname}:${externalPort}...`);
+	logger$2.log(`   Waiting for Postgres to be accessible at ${serverHostname}:${externalPort}...`);
 	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
 	const client = new pg.Client({
 		host: serverHostname,
@@ -5916,7 +5701,7 @@ async function initializePostgresUsers(api, postgres, serverHostname, users) {
 		await client.connect();
 		for (const user of users) {
 			const schemaName = user.usePublicSchema ? "public" : user.name;
-			logger$3.log(`   Creating user "${user.name}" with schema "${schemaName}"...`);
+			logger$2.log(`   Creating user "${user.name}" with schema "${schemaName}"...`);
 			if (user.usePublicSchema) {
 				await client.query(`
 					DO $$ BEGIN
@@ -5951,15 +5736,15 @@ async function initializePostgresUsers(api, postgres, serverHostname, users) {
 					ALTER DEFAULT PRIVILEGES IN SCHEMA "${schemaName}" GRANT ALL ON TABLES TO "${user.name}";
 				`);
 			}
-			logger$3.log(`   ✓ User "${user.name}" configured`);
+			logger$2.log(`   ✓ User "${user.name}" configured`);
 		}
 	} finally {
 		await client.end();
 	}
-	logger$3.log("   Disabling external port...");
+	logger$2.log("   Disabling external port...");
 	await api.savePostgresExternalPort(postgres.postgresId, null);
 	await api.deployPostgres(postgres.postgresId);
-	logger$3.log("   ✓ Database users initialized");
+	logger$2.log("   ✓ Database users initialized");
 }
 /**
 * Get the server hostname from the Dokploy endpoint URL
@@ -5973,24 +5758,24 @@ function getServerHostname(endpoint) {
 * @internal Exported for testing
 */
 async function provisionServices(api, projectId, environmentId, projectName, services, existingServiceIds) {
-	logger$3.log(`\n🔍 provisionServices called: services=${JSON.stringify(services)}, envId=${environmentId}`);
+	logger$2.log(`\n🔍 provisionServices called: services=${JSON.stringify(services)}, envId=${environmentId}`);
 	if (!services || !environmentId) {
-		logger$3.log("   Skipping: no services or no environmentId");
+		logger$2.log("   Skipping: no services or no environmentId");
 		return void 0;
 	}
 	const serviceUrls = {};
 	const serviceIds = {};
 	if (services.postgres) {
-		logger$3.log("\n🐘 Checking PostgreSQL...");
+		logger$2.log("\n🐘 Checking PostgreSQL...");
 		const postgresName = "db";
 		try {
 			let postgres = null;
 			let created = false;
 			if (existingServiceIds?.postgresId) {
-				logger$3.log(`   Using cached ID: ${existingServiceIds.postgresId}`);
+				logger$2.log(`   Using cached ID: ${existingServiceIds.postgresId}`);
 				postgres = await api.getPostgres(existingServiceIds.postgresId);
-				if (postgres) logger$3.log(`   ✓ PostgreSQL found: ${postgres.postgresId}`);
-				else logger$3.log(`   ⚠ Cached ID invalid, will create new`);
+				if (postgres) logger$2.log(`   ✓ PostgreSQL found: ${postgres.postgresId}`);
+				else logger$2.log(`   ⚠ Cached ID invalid, will create new`);
 			}
 			if (!postgres) {
 				const databasePassword = (0, node_crypto.randomBytes)(16).toString("hex");
@@ -6002,10 +5787,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 				postgres = result.postgres;
 				created = result.created;
 				if (created) {
-					logger$3.log(`   ✓ Created PostgreSQL: ${postgres.postgresId}`);
+					logger$2.log(`   ✓ Created PostgreSQL: ${postgres.postgresId}`);
 					await api.deployPostgres(postgres.postgresId);
-					logger$3.log("   ✓ PostgreSQL deployed");
-				} else logger$3.log(`   ✓ PostgreSQL already exists: ${postgres.postgresId}`);
+					logger$2.log("   ✓ PostgreSQL deployed");
+				} else logger$2.log(`   ✓ PostgreSQL already exists: ${postgres.postgresId}`);
 			}
 			serviceIds.postgresId = postgres.postgresId;
 			serviceUrls.DATABASE_HOST = postgres.appName;
@@ -6014,23 +5799,23 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 			serviceUrls.DATABASE_USER = postgres.databaseUser;
 			serviceUrls.DATABASE_PASSWORD = postgres.databasePassword;
 			serviceUrls.DATABASE_URL = `postgresql://${postgres.databaseUser}:${postgres.databasePassword}@${postgres.appName}:5432/${postgres.databaseName}`;
-			logger$3.log(`   ✓ Database credentials configured`);
+			logger$2.log(`   ✓ Database credentials configured`);
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$3.log(`   ⚠ Failed to provision PostgreSQL: ${message}`);
+			logger$2.log(`   ⚠ Failed to provision PostgreSQL: ${message}`);
 		}
 	}
 	if (services.redis) {
-		logger$3.log("\n🔴 Checking Redis...");
+		logger$2.log("\n🔴 Checking Redis...");
 		const redisName = "cache";
 		try {
 			let redis = null;
 			let created = false;
 			if (existingServiceIds?.redisId) {
-				logger$3.log(`   Using cached ID: ${existingServiceIds.redisId}`);
+				logger$2.log(`   Using cached ID: ${existingServiceIds.redisId}`);
 				redis = await api.getRedis(existingServiceIds.redisId);
-				if (redis) logger$3.log(`   ✓ Redis found: ${redis.redisId}`);
-				else logger$3.log(`   ⚠ Cached ID invalid, will create new`);
+				if (redis) logger$2.log(`   ✓ Redis found: ${redis.redisId}`);
+				else logger$2.log(`   ⚠ Cached ID invalid, will create new`);
 			}
 			if (!redis) {
 				const { randomBytes: randomBytes$2 } = await import("node:crypto");
@@ -6039,10 +5824,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 				redis = result.redis;
 				created = result.created;
 				if (created) {
-					logger$3.log(`   ✓ Created Redis: ${redis.redisId}`);
+					logger$2.log(`   ✓ Created Redis: ${redis.redisId}`);
 					await api.deployRedis(redis.redisId);
-					logger$3.log("   ✓ Redis deployed");
-				} else logger$3.log(`   ✓ Redis already exists: ${redis.redisId}`);
+					logger$2.log("   ✓ Redis deployed");
+				} else logger$2.log(`   ✓ Redis already exists: ${redis.redisId}`);
 			}
 			serviceIds.redisId = redis.redisId;
 			serviceUrls.REDIS_HOST = redis.appName;
@@ -6050,10 +5835,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 			if (redis.databasePassword) serviceUrls.REDIS_PASSWORD = redis.databasePassword;
 			const password = redis.databasePassword ? `:${redis.databasePassword}@` : "";
 			serviceUrls.REDIS_URL = `redis://${password}${redis.appName}:6379`;
-			logger$3.log(`   ✓ Redis credentials configured`);
+			logger$2.log(`   ✓ Redis credentials configured`);
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$3.log(`   ⚠ Failed to provision Redis: ${message}`);
+			logger$2.log(`   ⚠ Failed to provision Redis: ${message}`);
 		}
 	}
 	return Object.keys(serviceUrls).length > 0 ? {
@@ -6065,10 +5850,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 * Ensure Dokploy is fully configured, recovering/creating resources as needed
 */
 async function ensureDokploySetup(config, dockerConfig, stage, services) {
-	logger$3.log("\n🔧 Checking Dokploy setup...");
+	logger$2.log("\n🔧 Checking Dokploy setup...");
 	let creds = await require_credentials.getDokployCredentials();
 	if (!creds) {
-		logger$3.log("\n📋 Dokploy credentials not found. Let's set them up.");
+		logger$2.log("\n📋 Dokploy credentials not found. Let's set them up.");
 		const endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ");
 		const normalizedEndpoint = endpoint.replace(/\/$/, "");
 		try {
@@ -6076,9 +5861,9 @@ async function ensureDokploySetup(config, dockerConfig, stage, services) {
 		} catch {
 			throw new Error("Invalid URL format");
 		}
-		logger$3.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
+		logger$2.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
 		const token = await prompt("API Token: ", true);
-		logger$3.log("\nValidating credentials...");
+		logger$2.log("\nValidating credentials...");
 		const isValid = await validateDokployToken(normalizedEndpoint, token);
 		if (!isValid) throw new Error("Invalid credentials. Please check your token.");
 		await require_credentials.storeDokployCredentials(token, normalizedEndpoint);
@@ -6086,7 +5871,7 @@ async function ensureDokploySetup(config, dockerConfig, stage, services) {
 			token,
 			endpoint: normalizedEndpoint
 		};
-		logger$3.log("✓ Credentials saved");
+		logger$2.log("✓ Credentials saved");
 	}
 	const api = new require_dokploy_api.DokployApi({
 		baseUrl: creds.endpoint,
@@ -6094,20 +5879,20 @@ async function ensureDokploySetup(config, dockerConfig, stage, services) {
 	});
 	const existingConfig = config.providers?.dokploy;
 	if (existingConfig && typeof existingConfig !== "boolean" && existingConfig.applicationId && existingConfig.projectId) {
-		logger$3.log("✓ Dokploy config found in gkm.config.ts");
+		logger$2.log("✓ Dokploy config found in gkm.config.ts");
 		try {
 			const projectDetails = await api.getProject(existingConfig.projectId);
-			logger$3.log("✓ Project verified");
+			logger$2.log("✓ Project verified");
 			const storedRegistryId = existingConfig.registryId ?? await require_credentials.getDokployRegistryId();
 			const environments = projectDetails.environments ?? [];
 			let environment = environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 			if (!environment) {
-				logger$3.log(`   Creating "${stage}" environment...`);
+				logger$2.log(`   Creating "${stage}" environment...`);
 				environment = await api.createEnvironment(existingConfig.projectId, stage);
-				logger$3.log(`   ✓ Created environment: ${environment.environmentId}`);
+				logger$2.log(`   ✓ Created environment: ${environment.environmentId}`);
 			}
 			const environmentId$1 = environment.environmentId;
-			logger$3.log(`   Services config: ${JSON.stringify(services)}, envId: ${environmentId$1}`);
+			logger$2.log(`   Services config: ${JSON.stringify(services)}, envId: ${environmentId$1}`);
 			const provisionResult$1 = await provisionServices(api, existingConfig.projectId, environmentId$1, dockerConfig.appName, services, void 0);
 			return {
 				config: {
@@ -6120,97 +5905,97 @@ async function ensureDokploySetup(config, dockerConfig, stage, services) {
 				serviceUrls: provisionResult$1?.serviceUrls
 			};
 		} catch {
-			logger$3.log("⚠ Project not found, will recover...");
+			logger$2.log("⚠ Project not found, will recover...");
 		}
 	}
-	logger$3.log("\n📁 Looking for project...");
+	logger$2.log("\n📁 Looking for project...");
 	const projectName = dockerConfig.projectName;
 	const projects = await api.listProjects();
 	let project = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 	let environmentId;
 	if (project) {
-		logger$3.log(`   Found existing project: ${project.name} (${project.projectId})`);
+		logger$2.log(`   Found existing project: ${project.name} (${project.projectId})`);
 		const projectDetails = await api.getProject(project.projectId);
 		const environments = projectDetails.environments ?? [];
 		const matchingEnv = environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 		if (matchingEnv) {
 			environmentId = matchingEnv.environmentId;
-			logger$3.log(`   Using environment: ${matchingEnv.name}`);
+			logger$2.log(`   Using environment: ${matchingEnv.name}`);
 		} else {
-			logger$3.log(`   Creating "${stage}" environment...`);
+			logger$2.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
-			logger$3.log(`   ✓ Created environment: ${stage}`);
+			logger$2.log(`   ✓ Created environment: ${stage}`);
 		}
 	} else {
-		logger$3.log(`   Creating project: ${projectName}`);
+		logger$2.log(`   Creating project: ${projectName}`);
 		const result = await api.createProject(projectName);
 		project = result.project;
 		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
-			logger$3.log(`   Creating "${stage}" environment...`);
+			logger$2.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
 		} else environmentId = result.environment.environmentId;
-		logger$3.log(`   ✓ Created project: ${project.projectId}`);
-		logger$3.log(`   ✓ Using environment: ${stage}`);
+		logger$2.log(`   ✓ Created project: ${project.projectId}`);
+		logger$2.log(`   ✓ Using environment: ${stage}`);
 	}
-	logger$3.log("\n📦 Looking for application...");
+	logger$2.log("\n📦 Looking for application...");
 	const appName = dockerConfig.appName;
 	let applicationId;
 	if (existingConfig && typeof existingConfig !== "boolean" && existingConfig.applicationId) {
 		applicationId = existingConfig.applicationId;
-		logger$3.log(`   Using application from config: ${applicationId}`);
+		logger$2.log(`   Using application from config: ${applicationId}`);
 	} else {
-		logger$3.log(`   Creating application: ${appName}`);
+		logger$2.log(`   Creating application: ${appName}`);
 		const app = await api.createApplication(appName, project.projectId, environmentId);
 		applicationId = app.applicationId;
-		logger$3.log(`   ✓ Created application: ${applicationId}`);
+		logger$2.log(`   ✓ Created application: ${applicationId}`);
 	}
-	logger$3.log("\n🐳 Checking registry...");
+	logger$2.log("\n🐳 Checking registry...");
 	let registryId = await require_credentials.getDokployRegistryId();
 	if (registryId) try {
 		const registry = await api.getRegistry(registryId);
-		logger$3.log(`   Using registry: ${registry.registryName}`);
+		logger$2.log(`   Using registry: ${registry.registryName}`);
 	} catch {
-		logger$3.log("   ⚠ Stored registry not found, clearing...");
+		logger$2.log("   ⚠ Stored registry not found, clearing...");
 		registryId = void 0;
 		await require_credentials.storeDokployRegistryId("");
 	}
 	if (!registryId) {
 		const registries = await api.listRegistries();
 		if (registries.length === 0) if (dockerConfig.registry) {
-			logger$3.log("   No registries found in Dokploy. Let's create one.");
-			logger$3.log(`   Registry URL: ${dockerConfig.registry}`);
+			logger$2.log("   No registries found in Dokploy. Let's create one.");
+			logger$2.log(`   Registry URL: ${dockerConfig.registry}`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
 			const registry = await api.createRegistry("Default Registry", dockerConfig.registry, username, password);
 			registryId = registry.registryId;
 			await require_credentials.storeDokployRegistryId(registryId);
-			logger$3.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$3.log("   ⚠ No registry configured. Set docker.registry in gkm.config.ts");
+			logger$2.log(`   ✓ Registry created: ${registryId}`);
+		} else logger$2.log("   ⚠ No registry configured. Set docker.registry in gkm.config.ts");
 		else {
-			logger$3.log("   Available registries:");
+			logger$2.log("   Available registries:");
 			registries.forEach((reg, i) => {
-				logger$3.log(`     ${i + 1}. ${reg.registryName} (${reg.registryUrl})`);
+				logger$2.log(`     ${i + 1}. ${reg.registryName} (${reg.registryUrl})`);
 			});
-			if (dockerConfig.registry) logger$3.log(`     ${registries.length + 1}. Create new registry`);
+			if (dockerConfig.registry) logger$2.log(`     ${registries.length + 1}. Create new registry`);
 			const maxOption = dockerConfig.registry ? registries.length + 1 : registries.length;
 			const selection = await prompt(`   Select registry (1-${maxOption}): `);
 			const index = parseInt(selection, 10) - 1;
 			if (index >= 0 && index < registries.length) {
 				registryId = registries[index].registryId;
 				await require_credentials.storeDokployRegistryId(registryId);
-				logger$3.log(`   ✓ Selected: ${registries[index].registryName}`);
+				logger$2.log(`   ✓ Selected: ${registries[index].registryName}`);
 			} else if (dockerConfig.registry && index === registries.length) {
-				logger$3.log(`\n   Creating new registry...`);
-				logger$3.log(`   Registry URL: ${dockerConfig.registry}`);
+				logger$2.log(`\n   Creating new registry...`);
+				logger$2.log(`   Registry URL: ${dockerConfig.registry}`);
 				const username = await prompt("   Registry username: ");
 				const password = await prompt("   Registry password/token: ", true);
 				const registry = await api.createRegistry(dockerConfig.registry.replace(/^https?:\/\//, ""), dockerConfig.registry, username, password);
 				registryId = registry.registryId;
 				await require_credentials.storeDokployRegistryId(registryId);
-				logger$3.log(`   ✓ Registry created: ${registryId}`);
-			} else logger$3.log("   ⚠ Invalid selection, skipping registry setup");
+				logger$2.log(`   ✓ Registry created: ${registryId}`);
+			} else logger$2.log("   ⚠ Invalid selection, skipping registry setup");
 		}
 	}
 	const dokployConfig = {
@@ -6220,10 +6005,10 @@ async function ensureDokploySetup(config, dockerConfig, stage, services) {
 		registryId: registryId ?? void 0
 	};
 	await updateConfig(dokployConfig);
-	logger$3.log("\n✅ Dokploy setup complete!");
-	logger$3.log(`   Project: ${project.projectId}`);
-	logger$3.log(`   Application: ${applicationId}`);
-	if (registryId) logger$3.log(`   Registry: ${registryId}`);
+	logger$2.log("\n✅ Dokploy setup complete!");
+	logger$2.log(`   Project: ${project.projectId}`);
+	logger$2.log(`   Application: ${applicationId}`);
+	if (registryId) logger$2.log(`   Registry: ${registryId}`);
 	const provisionResult = await provisionServices(api, project.projectId, environmentId, dockerConfig.appName, services, void 0);
 	return {
 		config: dokployConfig,
@@ -6254,45 +6039,45 @@ function generateTag(stage) {
 async function workspaceDeployCommand(workspace, options) {
 	const { provider, stage, tag, apps: selectedApps } = options;
 	if (provider !== "dokploy") throw new Error(`Workspace deployment only supports Dokploy. Got: ${provider}`);
-	logger$3.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
-	logger$3.log(`   Stage: ${stage}`);
+	logger$2.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
+	logger$2.log(`   Stage: ${stage}`);
 	const imageTag = tag ?? generateTag(stage);
-	logger$3.log(`   Tag: ${imageTag}`);
+	logger$2.log(`   Tag: ${imageTag}`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	let appsToDeployNames = buildOrder;
 	if (selectedApps && selectedApps.length > 0) {
 		const invalidApps = selectedApps.filter((name$1) => !workspace.apps[name$1]);
 		if (invalidApps.length > 0) throw new Error(`Unknown apps: ${invalidApps.join(", ")}\nAvailable apps: ${Object.keys(workspace.apps).join(", ")}`);
 		appsToDeployNames = buildOrder.filter((name$1) => selectedApps.includes(name$1));
-		logger$3.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
-	} else logger$3.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
+		logger$2.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
+	} else logger$2.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
 	const dokployApps = appsToDeployNames.filter((name$1) => {
 		const app = workspace.apps[name$1];
 		const target = app.resolvedDeployTarget;
 		if (!require_workspace.isDeployTargetSupported(target)) {
-			logger$3.log(`   ⚠️  Skipping ${name$1}: ${require_workspace.getDeployTargetError(target, name$1)}`);
+			logger$2.log(`   ⚠️  Skipping ${name$1}: ${require_workspace.getDeployTargetError(target, name$1)}`);
 			return false;
 		}
 		return true;
 	});
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
-	logger$3.log("\n🔐 Loading secrets and analyzing environment requirements...");
+	logger$2.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const stageSecrets = await require_storage.readStageSecrets(stage, workspace.root);
 	if (!stageSecrets) {
-		logger$3.log(`   ⚠️  No secrets found for stage "${stage}"`);
-		logger$3.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
+		logger$2.log(`   ⚠️  No secrets found for stage "${stage}"`);
+		logger$2.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
 	}
 	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
 	if (stageSecrets) {
 		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
-		if (report.appsWithSecrets.length > 0) logger$3.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
-		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger$3.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
+		if (report.appsWithSecrets.length > 0) logger$2.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
+		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger$2.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
 	}
 	let creds = await require_credentials.getDokployCredentials();
 	if (!creds) {
-		logger$3.log("\n📋 Dokploy credentials not found. Let's set them up.");
+		logger$2.log("\n📋 Dokploy credentials not found. Let's set them up.");
 		const endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ");
 		const normalizedEndpoint = endpoint.replace(/\/$/, "");
 		try {
@@ -6300,9 +6085,9 @@ async function workspaceDeployCommand(workspace, options) {
 		} catch {
 			throw new Error("Invalid URL format");
 		}
-		logger$3.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
+		logger$2.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
 		const token = await prompt("API Token: ", true);
-		logger$3.log("\nValidating credentials...");
+		logger$2.log("\nValidating credentials...");
 		const isValid = await validateDokployToken(normalizedEndpoint, token);
 		if (!isValid) throw new Error("Invalid credentials. Please check your token.");
 		await require_credentials.storeDokployCredentials(token, normalizedEndpoint);
@@ -6310,43 +6095,43 @@ async function workspaceDeployCommand(workspace, options) {
 			token,
 			endpoint: normalizedEndpoint
 		};
-		logger$3.log("✓ Credentials saved");
+		logger$2.log("✓ Credentials saved");
 	}
 	const api = new require_dokploy_api.DokployApi({
 		baseUrl: creds.endpoint,
 		token: creds.token
 	});
-	logger$3.log("\n📁 Setting up Dokploy project...");
+	logger$2.log("\n📁 Setting up Dokploy project...");
 	const projectName = workspace.name;
 	const projects = await api.listProjects();
 	let project = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 	let environmentId;
 	if (project) {
-		logger$3.log(`   Found existing project: ${project.name}`);
+		logger$2.log(`   Found existing project: ${project.name}`);
 		const projectDetails = await api.getProject(project.projectId);
 		const environments = projectDetails.environments ?? [];
 		const matchingEnv = environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 		if (matchingEnv) {
 			environmentId = matchingEnv.environmentId;
-			logger$3.log(`   Using environment: ${matchingEnv.name}`);
+			logger$2.log(`   Using environment: ${matchingEnv.name}`);
 		} else {
-			logger$3.log(`   Creating "${stage}" environment...`);
+			logger$2.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
-			logger$3.log(`   ✓ Created environment: ${stage}`);
+			logger$2.log(`   ✓ Created environment: ${stage}`);
 		}
 	} else {
-		logger$3.log(`   Creating project: ${projectName}`);
+		logger$2.log(`   Creating project: ${projectName}`);
 		const result = await api.createProject(projectName);
 		project = result.project;
 		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
-			logger$3.log(`   Creating "${stage}" environment...`);
+			logger$2.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
 		} else environmentId = result.environment.environmentId;
-		logger$3.log(`   ✓ Created project: ${project.projectId}`);
+		logger$2.log(`   ✓ Created project: ${project.projectId}`);
 	}
-	logger$3.log("\n📋 Loading deploy state...");
+	logger$2.log("\n📋 Loading deploy state...");
 	const stateProvider = await createStateProvider({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
@@ -6354,27 +6139,27 @@ async function workspaceDeployCommand(workspace, options) {
 	});
 	let state = await stateProvider.read(stage);
 	if (state) {
-		logger$3.log(`   Found existing state for stage "${stage}"`);
+		logger$2.log(`   Found existing state for stage "${stage}"`);
 		if (state.projectId !== project.projectId) {
-			logger$3.log(`   ⚠ Project ID changed, updating state`);
+			logger$2.log(`   ⚠ Project ID changed, updating state`);
 			state.projectId = project.projectId;
 		}
 		if (state.environmentId !== environmentId) {
-			logger$3.log(`   ⚠ Environment ID changed, updating state`);
+			logger$2.log(`   ⚠ Environment ID changed, updating state`);
 			state.environmentId = environmentId;
 		}
 	} else {
-		logger$3.log(`   Creating new state for stage "${stage}"`);
+		logger$2.log(`   Creating new state for stage "${stage}"`);
 		state = createEmptyState(stage, project.projectId, environmentId);
 	}
-	logger$3.log("\n🐳 Checking registry...");
+	logger$2.log("\n🐳 Checking registry...");
 	let registryId = await require_credentials.getDokployRegistryId();
 	const registry = workspace.deploy.dokploy?.registry;
 	if (registryId) try {
 		const reg = await api.getRegistry(registryId);
-		logger$3.log(`   Using registry: ${reg.registryName}`);
+		logger$2.log(`   Using registry: ${reg.registryName}`);
 	} catch {
-		logger$3.log("   ⚠ Stored registry not found, clearing...");
+		logger$2.log("   ⚠ Stored registry not found, clearing...");
 		registryId = void 0;
 		await require_credentials.storeDokployRegistryId("");
 	}
@@ -6383,17 +6168,17 @@ async function workspaceDeployCommand(workspace, options) {
 		if (registries.length > 0) {
 			registryId = registries[0].registryId;
 			await require_credentials.storeDokployRegistryId(registryId);
-			logger$3.log(`   Using registry: ${registries[0].registryName}`);
+			logger$2.log(`   Using registry: ${registries[0].registryName}`);
 		} else if (registry) {
-			logger$3.log("   No registries found in Dokploy. Let's create one.");
-			logger$3.log(`   Registry URL: ${registry}`);
+			logger$2.log("   No registries found in Dokploy. Let's create one.");
+			logger$2.log(`   Registry URL: ${registry}`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
 			const reg = await api.createRegistry("Default Registry", registry, username, password);
 			registryId = reg.registryId;
 			await require_credentials.storeDokployRegistryId(registryId);
-			logger$3.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$3.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
+			logger$2.log(`   ✓ Registry created: ${registryId}`);
+		} else logger$2.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
 	}
 	const services = workspace.services;
 	const dockerServices = {
@@ -6403,7 +6188,7 @@ async function workspaceDeployCommand(workspace, options) {
 	let provisionedPostgres = null;
 	let provisionedRedis = null;
 	if (dockerServices.postgres || dockerServices.redis) {
-		logger$3.log("\n🔧 Provisioning infrastructure services...");
+		logger$2.log("\n🔧 Provisioning infrastructure services...");
 		const existingServiceIds = {
 			postgresId: getPostgresId(state),
 			redisId: getRedisId(state)
@@ -6421,7 +6206,7 @@ async function workspaceDeployCommand(workspace, options) {
 		}
 	}
 	const skippedMobileApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "mobile");
-	if (skippedMobileApps.length > 0) logger$3.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
+	if (skippedMobileApps.length > 0) logger$2.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "web");
 	const perAppDbCredentials = /* @__PURE__ */ new Map();
@@ -6431,13 +6216,13 @@ async function workspaceDeployCommand(workspace, options) {
 			return requirements?.requiredEnvVars.includes("DATABASE_URL");
 		});
 		if (appsNeedingDb.length > 0) {
-			logger$3.log(`\n🔐 Setting up per-app database credentials...`);
-			logger$3.log(`   Apps needing DATABASE_URL: ${appsNeedingDb.join(", ")}`);
+			logger$2.log(`\n🔐 Setting up per-app database credentials...`);
+			logger$2.log(`   Apps needing DATABASE_URL: ${appsNeedingDb.join(", ")}`);
 			const existingCredentials = getAllAppCredentials(state);
 			const usersToCreate = [];
 			for (const appName of appsNeedingDb) {
 				let credentials = existingCredentials[appName];
-				if (credentials) logger$3.log(`   ${appName}: Using existing credentials from state`);
+				if (credentials) logger$2.log(`   ${appName}: Using existing credentials from state`);
 				else {
 					const password = (0, node_crypto.randomBytes)(16).toString("hex");
 					credentials = {
@@ -6445,7 +6230,7 @@ async function workspaceDeployCommand(workspace, options) {
 						dbPassword: password
 					};
 					setAppCredentials(state, appName, credentials);
-					logger$3.log(`   ${appName}: Generated new credentials`);
+					logger$2.log(`   ${appName}: Generated new credentials`);
 				}
 				perAppDbCredentials.set(appName, credentials);
 				usersToCreate.push({
@@ -6459,8 +6244,8 @@ async function workspaceDeployCommand(workspace, options) {
 		}
 	}
 	if (workspace.deploy?.backups && provisionedPostgres) {
-		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-C4noe75O.cjs"));
+		logger$2.log("\n💾 Provisioning backup destination...");
+		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-B3HBN-2k.cjs"));
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -6468,13 +6253,13 @@ async function workspaceDeployCommand(workspace, options) {
 			stage,
 			config: workspace.deploy.backups,
 			existingState: getBackupState(state),
-			logger: logger$3
+			logger: logger$2
 		});
 		setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
-			logger$3.log("   Creating postgres backup schedule...");
+			logger$2.log("   Creating postgres backup schedule...");
 			const backup = await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
@@ -6485,8 +6270,8 @@ async function workspaceDeployCommand(workspace, options) {
 				keepLatestCount: backupRetention
 			});
 			setPostgresBackupId(state, backup.backupId);
-			logger$3.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
-		} else logger$3.log("   ✓ Using existing postgres backup schedule");
+			logger$2.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger$2.log("   ✓ Using existing postgres backup schedule");
 	}
 	const publicUrls = {};
 	const results = [];
@@ -6501,25 +6286,25 @@ async function workspaceDeployCommand(workspace, options) {
 		frontendUrls.push(`https://${hostname}`);
 	}
 	if (backendApps.length > 0) {
-		logger$3.log("\n📦 PHASE 1: Deploying backend applications...");
+		logger$2.log("\n📦 PHASE 1: Deploying backend applications...");
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
-			logger$3.log(`\n   ⚙️  Deploying ${appName}...`);
+			logger$2.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
 				const dokployAppName = appName;
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
-					logger$3.log(`      Using cached ID: ${cachedAppId}`);
+					logger$2.log(`      Using cached ID: ${cachedAppId}`);
 					application = await api.getApplication(cachedAppId);
-					if (application) logger$3.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$3.log(`      ⚠ Cached ID invalid, will create new`);
+					if (application) logger$2.log(`      ✓ Application found: ${application.applicationId}`);
+					else logger$2.log(`      ⚠ Cached ID invalid, will create new`);
 				}
 				if (!application) {
 					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
 					application = result.application;
-					if (result.created) logger$3.log(`      Created application: ${application.applicationId}`);
-					else logger$3.log(`      Found existing application: ${application.applicationId}`);
+					if (result.created) logger$2.log(`      Created application: ${application.applicationId}`);
+					else logger$2.log(`      Found existing application: ${application.applicationId}`);
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const appSecrets = encryptedSecrets.get(appName);
@@ -6527,11 +6312,11 @@ async function workspaceDeployCommand(workspace, options) {
 				if (appSecrets && appSecrets.secretCount > 0) {
 					buildArgs.push(`GKM_ENCRYPTED_CREDENTIALS=${appSecrets.payload.encrypted}`);
 					buildArgs.push(`GKM_CREDENTIALS_IV=${appSecrets.payload.iv}`);
-					logger$3.log(`      Encrypted ${appSecrets.secretCount} secrets`);
+					logger$2.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				}
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$3.log(`      Building Docker image: ${imageRef}`);
+				logger$2.log(`      Building Docker image: ${imageRef}`);
 				await deployDocker({
 					stage,
 					tag: imageTag,
@@ -6581,10 +6366,10 @@ async function workspaceDeployCommand(workspace, options) {
 				const { valid, missing, resolved } = validateEnvVars(requiredVars, envContext);
 				if (!valid) throw new Error(formatMissingVarsError(appName, missing, stage));
 				const envVars = Object.entries(resolved).map(([key, value]) => `${key}=${value}`);
-				if (Object.keys(resolved).length > 0) logger$3.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				if (Object.keys(resolved).length > 0) logger$2.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
 				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger$3.log(`      Deploying to Dokploy...`);
+				logger$2.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
 				const existingDomains = await api.getDomainsByApplicationId(application.applicationId);
 				const existingDomain = existingDomains.find((d) => d.host === backendHost);
@@ -6592,7 +6377,7 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, backendHost);
 					appDomainIds.set(appName, existingDomain.domainId);
 					publicUrls[appName] = `https://${backendHost}`;
-					logger$3.log(`      ✓ Domain: https://${backendHost} (existing)`);
+					logger$2.log(`      ✓ Domain: https://${backendHost} (existing)`);
 				} else try {
 					const domain = await api.createDomain({
 						host: backendHost,
@@ -6604,10 +6389,10 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, backendHost);
 					appDomainIds.set(appName, domain.domainId);
 					publicUrls[appName] = `https://${backendHost}`;
-					logger$3.log(`      ✓ Domain: https://${backendHost} (created)`);
+					logger$2.log(`      ✓ Domain: https://${backendHost} (created)`);
 				} catch (domainError) {
 					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$3.log(`      ⚠ Domain creation failed: ${message}`);
+					logger$2.log(`      ⚠ Domain creation failed: ${message}`);
 					appHostnames.set(appName, backendHost);
 					publicUrls[appName] = `https://${backendHost}`;
 				}
@@ -6618,10 +6403,10 @@ async function workspaceDeployCommand(workspace, options) {
 					applicationId: application.applicationId,
 					imageRef
 				});
-				logger$3.log(`      ✓ ${appName} deployed successfully`);
+				logger$2.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : "Unknown error";
-				logger$3.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+				logger$2.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 				results.push({
 					appName,
 					type: app.type,
@@ -6633,25 +6418,25 @@ async function workspaceDeployCommand(workspace, options) {
 		}
 	}
 	if (frontendApps.length > 0) {
-		logger$3.log("\n🌐 PHASE 2: Deploying frontend applications...");
+		logger$2.log("\n🌐 PHASE 2: Deploying frontend applications...");
 		for (const appName of frontendApps) {
 			const app = workspace.apps[appName];
-			logger$3.log(`\n   🌐 Deploying ${appName}...`);
+			logger$2.log(`\n   🌐 Deploying ${appName}...`);
 			try {
 				const dokployAppName = appName;
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
-					logger$3.log(`      Using cached ID: ${cachedAppId}`);
+					logger$2.log(`      Using cached ID: ${cachedAppId}`);
 					application = await api.getApplication(cachedAppId);
-					if (application) logger$3.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$3.log(`      ⚠ Cached ID invalid, will create new`);
+					if (application) logger$2.log(`      ✓ Application found: ${application.applicationId}`);
+					else logger$2.log(`      ⚠ Cached ID invalid, will create new`);
 				}
 				if (!application) {
 					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
 					application = result.application;
-					if (result.created) logger$3.log(`      Created application: ${application.applicationId}`);
-					else logger$3.log(`      Found existing application: ${application.applicationId}`);
+					if (result.created) logger$2.log(`      Created application: ${application.applicationId}`);
+					else logger$2.log(`      Found existing application: ${application.applicationId}`);
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const dependencyUrls = {};
@@ -6673,7 +6458,7 @@ async function workspaceDeployCommand(workspace, options) {
 				const sniffedVars = sniffedApps.get(appName)?.requiredEnvVars ?? [];
 				const { valid, missing, resolved } = validateEnvVars(sniffedVars, envContext);
 				if (!valid) throw new Error(formatMissingVarsError(appName, missing, stage));
-				if (Object.keys(resolved).length > 0) logger$3.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				if (Object.keys(resolved).length > 0) logger$2.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
 				const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
 				const buildArgs = [];
 				const publicUrlArgNames = [];
@@ -6683,10 +6468,10 @@ async function workspaceDeployCommand(workspace, options) {
 						publicUrlArgNames.push(key);
 					}
 				}
-				if (buildArgs.length > 0) logger$3.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
+				if (buildArgs.length > 0) logger$2.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$3.log(`      Building Docker image: ${imageRef}`);
+				logger$2.log(`      Building Docker image: ${imageRef}`);
 				await deployDocker({
 					stage,
 					tag: imageTag,
@@ -6707,7 +6492,7 @@ async function workspaceDeployCommand(workspace, options) {
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
 				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger$3.log(`      Deploying to Dokploy...`);
+				logger$2.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
 				const existingFrontendDomains = await api.getDomainsByApplicationId(application.applicationId);
 				const existingFrontendDomain = existingFrontendDomains.find((d) => d.host === frontendHost);
@@ -6715,7 +6500,7 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, frontendHost);
 					appDomainIds.set(appName, existingFrontendDomain.domainId);
 					publicUrls[appName] = `https://${frontendHost}`;
-					logger$3.log(`      ✓ Domain: https://${frontendHost} (existing)`);
+					logger$2.log(`      ✓ Domain: https://${frontendHost} (existing)`);
 				} else try {
 					const domain = await api.createDomain({
 						host: frontendHost,
@@ -6727,10 +6512,10 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, frontendHost);
 					appDomainIds.set(appName, domain.domainId);
 					publicUrls[appName] = `https://${frontendHost}`;
-					logger$3.log(`      ✓ Domain: https://${frontendHost} (created)`);
+					logger$2.log(`      ✓ Domain: https://${frontendHost} (created)`);
 				} catch (domainError) {
 					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$3.log(`      ⚠ Domain creation failed: ${message}`);
+					logger$2.log(`      ⚠ Domain creation failed: ${message}`);
 					appHostnames.set(appName, frontendHost);
 					publicUrls[appName] = `https://${frontendHost}`;
 				}
@@ -6741,10 +6526,10 @@ async function workspaceDeployCommand(workspace, options) {
 					applicationId: application.applicationId,
 					imageRef
 				});
-				logger$3.log(`      ✓ ${appName} deployed successfully`);
+				logger$2.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : "Unknown error";
-				logger$3.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+				logger$2.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 				results.push({
 					appName,
 					type: app.type,
@@ -6754,9 +6539,9 @@ async function workspaceDeployCommand(workspace, options) {
 			}
 		}
 	}
-	logger$3.log("\n📋 Saving deploy state...");
+	logger$2.log("\n📋 Saving deploy state...");
 	await stateProvider.write(stage, state);
-	logger$3.log("   ✓ State saved");
+	logger$2.log("   ✓ State saved");
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, creds.endpoint);
@@ -6765,27 +6550,27 @@ async function workspaceDeployCommand(workspace, options) {
 			await stateProvider.write(stage, state);
 		}
 		if (dnsResult?.success && appHostnames.size > 0) {
-			logger$3.log("\n🔒 Validating domains for SSL certificates...");
+			logger$2.log("\n🔒 Validating domains for SSL certificates...");
 			for (const [appName, hostname] of appHostnames) try {
 				const result = await api.validateDomain(hostname);
-				if (result.isValid) logger$3.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
-				else logger$3.log(`   ⚠ ${appName}: ${hostname} not valid`);
+				if (result.isValid) logger$2.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+				else logger$2.log(`   ⚠ ${appName}: ${hostname} not valid`);
 			} catch (validationError) {
 				const message = validationError instanceof Error ? validationError.message : "Unknown error";
-				logger$3.log(`   ⚠ ${appName}: validation failed - ${message}`);
+				logger$2.log(`   ⚠ ${appName}: validation failed - ${message}`);
 			}
 		}
 	}
 	const successCount = results.filter((r) => r.success).length;
 	const failedCount = results.filter((r) => !r.success).length;
-	logger$3.log(`\n${"─".repeat(50)}`);
-	logger$3.log(`\n✅ Workspace deployment complete!`);
-	logger$3.log(`   Project: ${project.projectId}`);
-	logger$3.log(`   Successful: ${successCount}`);
-	if (failedCount > 0) logger$3.log(`   Failed: ${failedCount}`);
+	logger$2.log(`\n${"─".repeat(50)}`);
+	logger$2.log(`\n✅ Workspace deployment complete!`);
+	logger$2.log(`   Project: ${project.projectId}`);
+	logger$2.log(`   Successful: ${successCount}`);
+	if (failedCount > 0) logger$2.log(`   Failed: ${failedCount}`);
 	if (Object.keys(publicUrls).length > 0) {
-		logger$3.log("\n   📡 Deployed URLs:");
-		for (const [name$1, url] of Object.entries(publicUrls)) logger$3.log(`      ${name$1}: ${url}`);
+		logger$2.log("\n   📡 Deployed URLs:");
+		for (const [name$1, url] of Object.entries(publicUrls)) logger$2.log(`      ${name$1}: ${url}`);
 	}
 	return {
 		apps: results,
@@ -6801,14 +6586,14 @@ async function deployCommand(options) {
 	const { provider, stage, tag, skipPush, skipBuild } = options;
 	const loadedConfig = await require_config.loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$3.log("📦 Detected workspace configuration");
+		logger$2.log("📦 Detected workspace configuration");
 		return workspaceDeployCommand(loadedConfig.workspace, options);
 	}
-	logger$3.log(`\n🚀 Deploying to ${provider}...`);
-	logger$3.log(`   Stage: ${stage}`);
+	logger$2.log(`\n🚀 Deploying to ${provider}...`);
+	logger$2.log(`   Stage: ${stage}`);
 	const config = await require_config.loadConfig();
 	const imageTag = tag ?? generateTag(stage);
-	logger$3.log(`   Tag: ${imageTag}`);
+	logger$2.log(`   Tag: ${imageTag}`);
 	const dockerConfig = resolveDockerConfig(config);
 	const imageName = dockerConfig.imageName;
 	const registry = dockerConfig.registry;
@@ -6817,7 +6602,7 @@ async function deployCommand(options) {
 	let finalRegistry = registry;
 	if (provider === "dokploy") {
 		const composeServices = config.docker?.compose?.services;
-		logger$3.log(`\n🔍 Docker compose config: ${JSON.stringify(config.docker?.compose)}`);
+		logger$2.log(`\n🔍 Docker compose config: ${JSON.stringify(config.docker?.compose)}`);
 		const dockerServices = composeServices ? Array.isArray(composeServices) ? {
 			postgres: composeServices.includes("postgres"),
 			redis: composeServices.includes("redis"),
@@ -6834,7 +6619,7 @@ async function deployCommand(options) {
 			const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1, initStageSecrets } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 			let secrets = await readStageSecrets$1(stage);
 			if (!secrets) {
-				logger$3.log(`   Creating secrets file for stage "${stage}"...`);
+				logger$2.log(`   Creating secrets file for stage "${stage}"...`);
 				secrets = initStageSecrets(stage);
 			}
 			let updated = false;
@@ -6849,12 +6634,12 @@ async function deployCommand(options) {
 					const urlKey = key;
 					if (!secrets.urls[urlKey]) {
 						secrets.urls[urlKey] = value;
-						logger$3.log(`   Saved ${key} to secrets.urls`);
+						logger$2.log(`   Saved ${key} to secrets.urls`);
 						updated = true;
 					}
 				} else if (!secrets.custom[key]) {
 					secrets.custom[key] = value;
-					logger$3.log(`   Saved ${key} to secrets.custom`);
+					logger$2.log(`   Saved ${key} to secrets.custom`);
 					updated = true;
 				}
 			}
@@ -6863,14 +6648,14 @@ async function deployCommand(options) {
 	}
 	let masterKey;
 	if (!skipBuild) {
-		logger$3.log(`\n📦 Building for production...`);
+		logger$2.log(`\n📦 Building for production...`);
 		const buildResult = await buildCommand({
 			provider: "server",
 			production: true,
 			stage
 		});
 		masterKey = buildResult.masterKey;
-	} else logger$3.log(`\n⏭️  Skipping build (--skip-build)`);
+	} else logger$2.log(`\n⏭️  Skipping build (--skip-build)`);
 	let result;
 	switch (provider) {
 		case "docker": {
@@ -6906,8 +6691,8 @@ async function deployCommand(options) {
 			break;
 		}
 		case "aws-lambda": {
-			logger$3.log("\n⚠️  AWS Lambda deployment is not yet implemented.");
-			logger$3.log("   Use SST or AWS CDK for Lambda deployments.");
+			logger$2.log("\n⚠️  AWS Lambda deployment is not yet implemented.");
+			logger$2.log("   Use SST or AWS CDK for Lambda deployments.");
 			result = {
 				imageRef,
 				masterKey
@@ -6916,7 +6701,7 @@ async function deployCommand(options) {
 		}
 		default: throw new Error(`Unknown deploy provider: ${provider}\nSupported providers: docker, dokploy, aws-lambda`);
 	}
-	logger$3.log("\n✅ Deployment complete!");
+	logger$2.log("\n✅ Deployment complete!");
 	return result;
 }
 
@@ -7113,22 +6898,22 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/audit": "~2.0.1",
 	"@geekmidas/auth": "~2.0.1",
 	"@geekmidas/cache": "~1.1.1",
-	"@geekmidas/client": "~5.0.0",
+	"@geekmidas/client": "~6.0.0",
 	"@geekmidas/cloud": "~1.0.1",
-	"@geekmidas/constructs": "~3.1.0",
+	"@geekmidas/constructs": "~4.0.1",
 	"@geekmidas/db": "~1.0.2",
 	"@geekmidas/emailkit": "~1.0.1",
 	"@geekmidas/envkit": "~1.0.7",
 	"@geekmidas/errors": "~1.0.1",
 	"@geekmidas/events": "~1.1.4",
 	"@geekmidas/logger": "~1.0.2",
-	"@geekmidas/rate-limit": "~2.0.1",
-	"@geekmidas/schema": "~1.0.2",
-	"@geekmidas/services": "~1.0.4",
+	"@geekmidas/rate-limit": "~3.0.0",
+	"@geekmidas/schema": "~1.0.3",
+	"@geekmidas/services": "~1.1.1",
 	"@geekmidas/storage": "~2.0.3",
 	"@geekmidas/studio": "~1.0.1",
 	"@geekmidas/telescope": "~1.0.1",
-	"@geekmidas/testkit": "~1.0.9",
+	"@geekmidas/testkit": "~2.0.0",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -12868,7 +12653,7 @@ function printNextSteps(projectName, options, pkgManager) {
 
 //#endregion
 //#region src/secrets/index.ts
-const logger$2 = console;
+const logger$1 = console;
 /**
 * Extract service names from compose config.
 */
@@ -12884,12 +12669,12 @@ function getServicesFromConfig(services) {
 async function secretsInitCommand(options) {
 	const { stage, force } = options;
 	if (!force && require_storage.secretsExist(stage)) {
-		logger$2.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
+		logger$1.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
 		process.exit(1);
 	}
 	const config = await require_config.loadConfig();
 	const services = getServicesFromConfig(config.docker?.compose?.services);
-	if (services.length === 0) logger$2.warn("No services configured in docker.compose.services. Creating secrets with empty services.");
+	if (services.length === 0) logger$1.warn("No services configured in docker.compose.services. Creating secrets with empty services.");
 	let projectName;
 	let workspaceSecrets;
 	try {
@@ -12898,23 +12683,23 @@ async function secretsInitCommand(options) {
 		const isMultiApp = Object.keys(loaded.workspace.apps).length > 1;
 		if (isMultiApp) {
 			workspaceSecrets = require_fullstack_secrets.generateFullstackCustomSecrets(loaded.workspace);
-			logger$2.log("  Detected workspace mode — generating per-app secrets");
+			logger$1.log("  Detected workspace mode — generating per-app secrets");
 		}
 	} catch {}
 	const secrets = require_fullstack_secrets.createStageSecrets(stage, services, { projectName });
 	if (workspaceSecrets) secrets.custom = workspaceSecrets;
 	await require_storage.writeStageSecrets(secrets);
-	logger$2.log(`\n✓ Secrets initialized for stage "${stage}"`);
-	logger$2.log(`  Location: .gkm/secrets/${stage}.json`);
-	logger$2.log("\n  Generated credentials for:");
-	for (const service of services) logger$2.log(`    - ${service}`);
-	if (secrets.urls.DATABASE_URL) logger$2.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
-	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger$2.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
-	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
-	if (Object.keys(secrets.custom).length > 0) logger$2.log(`\n  Custom secrets: ${Object.keys(secrets.custom).length}`);
-	logger$2.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
-	logger$2.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
+	logger$1.log(`\n✓ Secrets initialized for stage "${stage}"`);
+	logger$1.log(`  Location: .gkm/secrets/${stage}.json`);
+	logger$1.log("\n  Generated credentials for:");
+	for (const service of services) logger$1.log(`    - ${service}`);
+	if (secrets.urls.DATABASE_URL) logger$1.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger$1.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.RABBITMQ_URL) logger$1.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
+	if (secrets.urls.STORAGE_ENDPOINT) logger$1.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
+	if (Object.keys(secrets.custom).length > 0) logger$1.log(`\n  Custom secrets: ${Object.keys(secrets.custom).length}`);
+	logger$1.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
+	logger$1.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
 }
 /**
 * Read all data from stdin.
@@ -12933,21 +12718,21 @@ async function secretsSetCommand(key, value, options) {
 	let secretValue = value;
 	if (!secretValue) {
 		if (process.stdin.isTTY) {
-			logger$2.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
-			logger$2.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
+			logger$1.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
+			logger$1.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
 			process.exit(1);
 		}
 		secretValue = await readStdin();
 		if (!secretValue) {
-			logger$2.error("No value received from stdin");
+			logger$1.error("No value received from stdin");
 			process.exit(1);
 		}
 	}
 	try {
 		await require_storage.setCustomSecret(stage, key, secretValue);
-		logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
+		logger$1.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
 	} catch (error) {
-		logger$2.error(error instanceof Error ? error.message : "Failed to set secret");
+		logger$1.error(error instanceof Error ? error.message : "Failed to set secret");
 		process.exit(1);
 	}
 }
@@ -12958,34 +12743,34 @@ async function secretsShowCommand(options) {
 	const { stage, reveal } = options;
 	const secrets = await require_storage.readStageSecrets(stage);
 	if (!secrets) {
-		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$1.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
-	logger$2.log(`\nSecrets for stage "${stage}":`);
-	logger$2.log(`  Created: ${secrets.createdAt}`);
-	logger$2.log(`  Updated: ${secrets.updatedAt}`);
-	logger$2.log("\nService Credentials:");
+	logger$1.log(`\nSecrets for stage "${stage}":`);
+	logger$1.log(`  Created: ${secrets.createdAt}`);
+	logger$1.log(`  Updated: ${secrets.updatedAt}`);
+	logger$1.log("\nService Credentials:");
 	for (const [service, creds] of Object.entries(secrets.services)) if (creds) {
-		logger$2.log(`\n  ${service}:`);
-		logger$2.log(`    host: ${creds.host}`);
-		logger$2.log(`    port: ${creds.port}`);
-		logger$2.log(`    username: ${creds.username}`);
-		logger$2.log(`    password: ${reveal ? creds.password : require_storage.maskPassword(creds.password)}`);
-		if (creds.database) logger$2.log(`    database: ${creds.database}`);
-		if (creds.vhost) logger$2.log(`    vhost: ${creds.vhost}`);
-		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
-	}
-	logger$2.log("\nConnection URLs:");
-	if (secrets.urls.DATABASE_URL) logger$2.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
-	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger$2.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
-	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
+		logger$1.log(`\n  ${service}:`);
+		logger$1.log(`    host: ${creds.host}`);
+		logger$1.log(`    port: ${creds.port}`);
+		logger$1.log(`    username: ${creds.username}`);
+		logger$1.log(`    password: ${reveal ? creds.password : require_storage.maskPassword(creds.password)}`);
+		if (creds.database) logger$1.log(`    database: ${creds.database}`);
+		if (creds.vhost) logger$1.log(`    vhost: ${creds.vhost}`);
+		if (creds.bucket) logger$1.log(`    bucket: ${creds.bucket}`);
+	}
+	logger$1.log("\nConnection URLs:");
+	if (secrets.urls.DATABASE_URL) logger$1.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger$1.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.RABBITMQ_URL) logger$1.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
+	if (secrets.urls.STORAGE_ENDPOINT) logger$1.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	const customKeys = Object.keys(secrets.custom);
 	if (customKeys.length > 0) {
-		logger$2.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_storage.maskPassword(value)}`);
+		logger$1.log("\nCustom Secrets:");
+		for (const [key, value] of Object.entries(secrets.custom)) logger$1.log(`  ${key}: ${reveal ? value : require_storage.maskPassword(value)}`);
 	}
-	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
+	if (!reveal) logger$1.log("\nUse --reveal to show actual values");
 }
 /**
 * Rotate passwords for services.
@@ -12994,25 +12779,25 @@ async function secretsRotateCommand(options) {
 	const { stage, service } = options;
 	const secrets = await require_storage.readStageSecrets(stage);
 	if (!secrets) {
-		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$1.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
 	if (service) {
 		if (!secrets.services[service]) {
-			logger$2.error(`Service "${service}" not configured in stage "${stage}"`);
+			logger$1.error(`Service "${service}" not configured in stage "${stage}"`);
 			process.exit(1);
 		}
 		const updated = require_fullstack_secrets.rotateServicePassword(secrets, service);
 		await require_storage.writeStageSecrets(updated);
-		logger$2.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
+		logger$1.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
 	} else {
 		let updated = secrets;
 		const services = Object.keys(secrets.services);
 		for (const svc of services) updated = require_fullstack_secrets.rotateServicePassword(updated, svc);
 		await require_storage.writeStageSecrets(updated);
-		logger$2.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
+		logger$1.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
 	}
-	logger$2.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
+	logger$1.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
 }
 /**
 * Import secrets from a JSON file.
@@ -13020,7 +12805,7 @@ async function secretsRotateCommand(options) {
 async function secretsImportCommand(file, options) {
 	const { stage, merge = true } = options;
 	if (!(0, node_fs.existsSync)(file)) {
-		logger$2.error(`File not found: ${file}`);
+		logger$1.error(`File not found: ${file}`);
 		process.exit(1);
 	}
 	let importedSecrets;
@@ -13030,12 +12815,12 @@ async function secretsImportCommand(file, options) {
 		if (typeof importedSecrets !== "object" || importedSecrets === null) throw new Error("JSON must be an object");
 		for (const [key, value] of Object.entries(importedSecrets)) if (typeof value !== "string") throw new Error(`Value for "${key}" must be a string, got ${typeof value}`);
 	} catch (error) {
-		logger$2.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
+		logger$1.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
 		process.exit(1);
 	}
 	const secrets = await require_storage.readStageSecrets(stage);
 	if (!secrets) {
-		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$1.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
 	const updatedCustom = merge ? {
@@ -13050,10 +12835,10 @@ async function secretsImportCommand(file, options) {
 	await require_storage.writeStageSecrets(updated);
 	const importedCount = Object.keys(importedSecrets).length;
 	const totalCount = Object.keys(updatedCustom).length;
-	logger$2.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
-	if (merge && totalCount > importedCount) logger$2.log(`  Total custom secrets: ${totalCount}`);
-	logger$2.log("\n  Imported keys:");
-	for (const key of Object.keys(importedSecrets)) logger$2.log(`    - ${key}`);
+	logger$1.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
+	if (merge && totalCount > importedCount) logger$1.log(`  Total custom secrets: ${totalCount}`);
+	logger$1.log("\n  Imported keys:");
+	for (const key of Object.keys(importedSecrets)) logger$1.log(`    - ${key}`);
 }
 /**
 * Mask password in a URL for display.
@@ -13068,264 +12853,6 @@ function maskUrl(url) {
 	}
 }
 
-//#endregion
-//#region src/setup/index.ts
-const logger$1 = console;
-/**
-* Setup development environment.
-*
-* Orchestrates:
-* 1. Load workspace config
-* 2. Resolve secrets (local → SSM → generate fresh)
-* 3. Write docker/.env from secrets
-* 4. Start Docker services
-*/
-async function setupCommand(options = {}) {
-	const stage = options.stage ?? "development";
-	logger$1.log("\n🔧 Setting up development environment...\n");
-	let loadedConfig;
-	try {
-		loadedConfig = await require_config.loadWorkspaceConfig();
-	} catch {
-		logger$1.error("❌ No gkm.config.ts found. Run this command from a workspace root.");
-		process.exit(1);
-	}
-	const { workspace } = loadedConfig;
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	logger$1.log(`📦 Workspace: ${workspace.name}`);
-	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
-	logger$1.log(`🔑 Stage: ${stage}\n`);
-	const secrets = await resolveSecrets(stage, workspace, options);
-	if (!secrets) {
-		logger$1.error("❌ Failed to resolve secrets. Exiting.");
-		process.exit(1);
-	}
-	if (isMultiApp && workspace.services.db) {
-		await require_fullstack_secrets.writeDockerEnvFromSecrets(secrets, workspace.root);
-		logger$1.log("📄 Generated docker/.env with database passwords");
-	}
-	if (!options.skipDocker) {
-		const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
-		if ((0, node_fs.existsSync)(composeFile)) {
-			logger$1.log("");
-			const resolvedPorts = await resolveServicePorts(workspace.root);
-			await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
-		} else logger$1.log("⚠️  No docker-compose.yml found. Skipping Docker services.");
-	}
-	printSummary(workspace, stage);
-}
-/**
-* Resolve secrets with priority:
-* 1. Local secrets exist → use them (preserves manual additions)
-* 2. SSM configured and has secrets → pull and use
-* 3. Neither → generate fresh secrets
-*
-* --force skips checks 1 and 2 and always regenerates.
-*/
-async function resolveSecrets(stage, workspace, options) {
-	if (options.force) {
-		logger$1.log("🔐 Generating fresh secrets (--force)...");
-		return generateFreshSecrets(stage, workspace, options);
-	}
-	if (require_storage.secretsExist(stage, workspace.root)) {
-		logger$1.log("🔐 Using existing local secrets");
-		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			const reconciled = reconcileSecrets(secrets, workspace);
-			if (reconciled) await require_storage.writeStageSecrets(reconciled, workspace.root);
-			return reconciled ?? secrets;
-		}
-	}
-	if (require_sync.isSSMConfigured(workspace)) {
-		logger$1.log("☁️  Checking for remote secrets in SSM...");
-		try {
-			const remoteSecrets = await require_sync.pullSecrets(stage, workspace);
-			if (remoteSecrets) {
-				logger$1.log("✅ Pulled secrets from SSM");
-				await require_storage.writeStageSecrets(remoteSecrets, workspace.root);
-				return remoteSecrets;
-			}
-			logger$1.log("   No remote secrets found");
-		} catch (error) {
-			logger$1.warn(`⚠️  Failed to pull from SSM: ${error.message}`);
-		}
-	}
-	logger$1.log("🔐 Generating fresh development secrets...");
-	return generateFreshSecrets(stage, workspace, options);
-}
-/**
-* Reconcile existing secrets with expected workspace-derived keys.
-* Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.
-* Returns the updated secrets if changes were made, or null if no changes needed.
-* @internal Exported for testing
-*/
-function reconcileSecrets(secrets, workspace) {
-	let changed = false;
-	let result = { ...secrets };
-	const serviceMap = [
-		{
-			key: "db",
-			name: "postgres"
-		},
-		{
-			key: "cache",
-			name: "redis"
-		},
-		{
-			key: "storage",
-			name: "minio"
-		},
-		{
-			key: "mail",
-			name: "mailpit"
-		}
-	];
-	for (const { key, name: name$1 } of serviceMap) if (workspace.services[key] && !result.services[name$1]) {
-		const creds = require_fullstack_secrets.generateServiceCredentials(name$1);
-		if (name$1 === "minio") {
-			creds.bucket = workspace.name;
-			creds.username = workspace.name;
-		}
-		result = {
-			...result,
-			services: {
-				...result.services,
-				[name$1]: creds
-			}
-		};
-		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, result.eventsBackend);
-		logger$1.log(`   🔄 Adding missing service credentials: ${name$1}`);
-		changed = true;
-	}
-	if (result.services.postgres && !result.services.pgboss) {
-		result = {
-			...result,
-			services: {
-				...result.services,
-				pgboss: {
-					host: result.services.postgres.host,
-					port: result.services.postgres.port,
-					username: "pgboss",
-					password: require_fullstack_secrets.generateSecurePassword(),
-					database: result.services.postgres.database ?? "app"
-				}
-			}
-		};
-		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, result.eventsBackend);
-		logger$1.log("   🔄 Adding missing service credentials: pgboss");
-		changed = true;
-	}
-	const eventsBackend = workspace.services.events;
-	if (eventsBackend && result.eventsBackend !== eventsBackend) {
-		result.eventsBackend = eventsBackend;
-		if (eventsBackend === "sns" && !result.services.localstack) {
-			result = {
-				...result,
-				services: {
-					...result.services,
-					localstack: require_fullstack_secrets.generateLocalStackCredentials()
-				}
-			};
-			logger$1.log("   🔄 Adding missing service credentials: localstack");
-			changed = true;
-		}
-		if (eventsBackend === "rabbitmq" && !result.services.rabbitmq) {
-			result = {
-				...result,
-				services: {
-					...result.services,
-					rabbitmq: require_fullstack_secrets.generateServiceCredentials("rabbitmq")
-				}
-			};
-			logger$1.log("   🔄 Adding missing service credentials: rabbitmq");
-			changed = true;
-		}
-		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, eventsBackend);
-		changed = true;
-	}
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (isMultiApp) {
-		const expected = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
-		const missing = {};
-		for (const [key, value] of Object.entries(expected)) if (!(key in result.custom)) missing[key] = value;
-		if (Object.keys(missing).length > 0) {
-			logger$1.log(`   🔄 Adding missing secrets: ${Object.keys(missing).join(", ")}`);
-			result = {
-				...result,
-				custom: {
-					...result.custom,
-					...missing
-				}
-			};
-			changed = true;
-		}
-	}
-	if (!changed) return null;
-	return {
-		...result,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Generate fresh secrets for the workspace.
-*/
-async function generateFreshSecrets(stage, workspace, options) {
-	const serviceNames = [];
-	if (workspace.services.db) serviceNames.push("postgres");
-	if (workspace.services.cache) serviceNames.push("redis");
-	if (workspace.services.storage) serviceNames.push("minio");
-	if (workspace.services.mail) serviceNames.push("mailpit");
-	if (workspace.services.events === "sns") serviceNames.push("localstack");
-	if (workspace.services.events === "rabbitmq") serviceNames.push("rabbitmq");
-	const secrets = require_fullstack_secrets.createStageSecrets(stage, serviceNames, {
-		projectName: workspace.name,
-		eventsBackend: workspace.services.events
-	});
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (isMultiApp) {
-		const customSecrets = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
-		secrets.custom = customSecrets;
-	} else secrets.custom = {
-		NODE_ENV: "development",
-		PORT: "3000",
-		LOG_LEVEL: "debug",
-		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
-	};
-	await require_storage.writeStageSecrets(secrets, workspace.root);
-	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-	if (require_sync.isSSMConfigured(workspace) && !options.yes) {
-		const { shouldPush } = await (0, prompts.default)({
-			type: "confirm",
-			name: "shouldPush",
-			message: "Push secrets to SSM for team sharing?",
-			initial: true
-		});
-		if (shouldPush) try {
-			await require_sync.pushSecrets(stage, workspace);
-			logger$1.log("☁️  Secrets pushed to SSM");
-		} catch (error) {
-			logger$1.warn(`⚠️  Failed to push to SSM: ${error.message}`);
-		}
-	}
-	return secrets;
-}
-/**
-* Print setup summary with next steps.
-*/
-function printSummary(workspace, stage) {
-	logger$1.log(`\n${"─".repeat(50)}`);
-	logger$1.log("\n✅ Development environment ready!\n");
-	logger$1.log("📋 Apps:");
-	for (const [name$1, app] of Object.entries(workspace.apps)) {
-		const icon = app.type === "web" ? "🌐" : app.type === "mobile" ? "📱" : "🔧";
-		logger$1.log(`   ${icon} ${name$1} → http://localhost:${app.port}`);
-	}
-	logger$1.log("\n🚀 Next steps:");
-	logger$1.log("   gkm dev                    # Start all apps");
-	logger$1.log(`   gkm secrets:show --stage ${stage}  # View secrets`);
-	logger$1.log("");
-}
-
 //#endregion
 //#region src/test/index.ts
 /**
@@ -13336,9 +12863,15 @@ async function testCommand(options = {}) {
 	const stage = options.stage ?? "development";
 	const cwd = process.cwd();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
-	const defaultEnv = loadEnvFiles(".env");
+	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
+	if (autoSetup) {
+		const { ensureStageSecrets } = await Promise.resolve().then(() => require("./setup-DLwhfyt-.cjs"));
+		const generated = await ensureStageSecrets(stage, cwd);
+		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
+	}
+	const defaultEnv = require_setup.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const result = await prepareEntryCredentials({
+	const result = await require_setup.prepareEntryCredentials({
 		stages: [stage],
 		startDocker: true,
 		secretsFileName: "test-secrets.json",
@@ -13360,7 +12893,7 @@ async function testCommand(options = {}) {
 	await (0, node_fs_promises.writeFile)(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = (0, node_path.join)(cwd, ".gkm");
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
-	await createCredentialsPreload(preloadPath, result.secretsJsonPath);
+	await require_setup.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const existingNodeOptions = process.env.NODE_OPTIONS ?? "";
 	const tsxImport = "--import=tsx";
 	const preloadImport = `--import=${preloadPath}`;
@@ -13385,9 +12918,9 @@ async function testCommand(options = {}) {
 			NODE_OPTIONS: nodeOptions
 		}
 	});
-	return new Promise((resolve$4, reject) => {
+	return new Promise((resolve$3, reject) => {
 		vitestProcess.on("close", (code) => {
-			if (code === 0) resolve$4();
+			if (code === 0) resolve$3();
 			else reject(new Error(`Tests failed with exit code ${code}`));
 		});
 		vitestProcess.on("error", (error) => {
@@ -13580,7 +13113,7 @@ program.command("setup").description("Setup development environment (secrets, Do
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await setupCommand(options);
+		await require_setup.setupCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -13648,7 +13181,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from", "development").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from", "development").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -13790,8 +13323,8 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushSecrets: pushSecrets$1 } = await Promise.resolve().then(() => require("./sync-D1Pa30oV.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-D93YG7G5.cjs"));
+		const { pushSecrets } = await Promise.resolve().then(() => require("./sync-BLA94rgC.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-BzqKJ2Rt.cjs"));
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
@@ -13803,7 +13336,7 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 				for (const key of result.addedKeys) console.log(`    + ${key}`);
 			}
 		}
-		await pushSecrets$1(options.stage, workspace);
+		await pushSecrets(options.stage, workspace);
 		console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
 	} catch (error) {
 		console.error(formatError(error));
@@ -13815,11 +13348,11 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullSecrets: pullSecrets$1 } = await Promise.resolve().then(() => require("./sync-D1Pa30oV.cjs"));
+		const { pullSecrets } = await Promise.resolve().then(() => require("./sync-BLA94rgC.cjs"));
 		const { writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-D93YG7G5.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-BzqKJ2Rt.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
-		let secrets = await pullSecrets$1(options.stage, workspace);
+		let secrets = await pullSecrets(options.stage, workspace);
 		if (!secrets) {
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
@@ -13842,7 +13375,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-D93YG7G5.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-BzqKJ2Rt.cjs"));
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DOEtT2Hr.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);