@geekmidas/cli 1.8.0 → 1.9.1

package/dist/index.mjs

@@ -8,7 +8,9 @@ import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecr
 import { DokployApi } from "./dokploy-api-2ldYoN3i.mjs";
 import { encryptSecrets } from "./encryption-BOH5M-f-.mjs";
 import { CachedStateProvider } from "./CachedStateProvider-BDq5WqSy.mjs";
-import { generateReactQueryCommand } from "./openapi-react-query-DaTMSPD5.mjs";
+import { createStageSecrets, generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, rotateServicePassword, writeDockerEnvFromSecrets } from "./fullstack-secrets-UZAFWuH4.mjs";
+import { generateReactQueryCommand } from "./openapi-react-query-C4UdILaI.mjs";
+import { isSSMConfigured, pullSecrets, pushSecrets } from "./sync-CbeKrnQV.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { basename, dirname, join, parse, relative, resolve } from "node:path";
@@ -33,7 +35,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.7.0";
+var version = "1.9.0";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -131,7 +133,7 @@ var package_default = {
 
 //#endregion
 //#region src/auth/index.ts
-const logger$11 = console;
+const logger$13 = console;
 /**
 * Validate Dokploy token by making a test API call
 */
@@ -199,36 +201,36 @@ async function prompt$1(message, hidden = false) {
 async function loginCommand(options) {
 	const { service, token: providedToken, endpoint: providedEndpoint } = options;
 	if (service === "dokploy") {
-		logger$11.log("\n🔐 Logging in to Dokploy...\n");
+		logger$13.log("\n🔐 Logging in to Dokploy...\n");
 		let endpoint = providedEndpoint;
 		if (!endpoint) endpoint = await prompt$1("Dokploy URL (e.g., https://dokploy.example.com): ");
 		endpoint = endpoint.replace(/\/$/, "");
 		try {
 			new URL(endpoint);
 		} catch {
-			logger$11.error("Invalid URL format");
+			logger$13.error("Invalid URL format");
 			process.exit(1);
 		}
 		let token = providedToken;
 		if (!token) {
-			logger$11.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			logger$13.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
 			token = await prompt$1("API Token: ", true);
 		}
 		if (!token) {
-			logger$11.error("Token is required");
+			logger$13.error("Token is required");
 			process.exit(1);
 		}
-		logger$11.log("\nValidating credentials...");
+		logger$13.log("\nValidating credentials...");
 		const isValid = await validateDokployToken(endpoint, token);
 		if (!isValid) {
-			logger$11.error("\n✗ Invalid credentials. Please check your token and try again.");
+			logger$13.error("\n✗ Invalid credentials. Please check your token and try again.");
 			process.exit(1);
 		}
 		await storeDokployCredentials(token, endpoint);
-		logger$11.log("\n✓ Successfully logged in to Dokploy!");
-		logger$11.log(`  Endpoint: ${endpoint}`);
-		logger$11.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger$11.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+		logger$13.log("\n✓ Successfully logged in to Dokploy!");
+		logger$13.log(`  Endpoint: ${endpoint}`);
+		logger$13.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$13.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
 }
 /**
@@ -238,28 +240,28 @@ async function logoutCommand(options) {
 	const { service = "dokploy" } = options;
 	if (service === "all") {
 		const dokployRemoved = await removeDokployCredentials();
-		if (dokployRemoved) logger$11.log("\n✓ Logged out from all services");
-		else logger$11.log("\nNo stored credentials found");
+		if (dokployRemoved) logger$13.log("\n✓ Logged out from all services");
+		else logger$13.log("\nNo stored credentials found");
 		return;
 	}
 	if (service === "dokploy") {
 		const removed = await removeDokployCredentials();
-		if (removed) logger$11.log("\n✓ Logged out from Dokploy");
-		else logger$11.log("\nNo Dokploy credentials found");
+		if (removed) logger$13.log("\n✓ Logged out from Dokploy");
+		else logger$13.log("\nNo Dokploy credentials found");
 	}
 }
 /**
 * Show current login status
 */
 async function whoamiCommand() {
-	logger$11.log("\n📋 Current credentials:\n");
+	logger$13.log("\n📋 Current credentials:\n");
 	const dokploy = await getDokployCredentials();
 	if (dokploy) {
-		logger$11.log("  Dokploy:");
-		logger$11.log(`    Endpoint: ${dokploy.endpoint}`);
-		logger$11.log(`    Token: ${maskToken(dokploy.token)}`);
-	} else logger$11.log("  Dokploy: Not logged in");
-	logger$11.log(`\n  Credentials file: ${getCredentialsPath()}`);
+		logger$13.log("  Dokploy:");
+		logger$13.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$13.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$13.log("  Dokploy: Not logged in");
+	logger$13.log(`\n  Credentials file: ${getCredentialsPath()}`);
 }
 /**
 * Mask a token for display
@@ -345,7 +347,7 @@ function isEnabled(config$1) {
 var CronGenerator = class extends ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$12 = console;
+		const logger$14 = console;
 		const cronInfos = [];
 		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
 		const cronsDir = join(outputDir, "crons");
@@ -360,7 +362,7 @@ var CronGenerator = class extends ConstructGenerator {
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment()
 			});
-			logger$12.log(`Generated cron handler: ${key}`);
+			logger$14.log(`Generated cron handler: ${key}`);
 		}
 		return cronInfos;
 	}
@@ -396,7 +398,7 @@ var FunctionGenerator = class extends ConstructGenerator {
 	}
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$12 = console;
+		const logger$14 = console;
 		const functionInfos = [];
 		if (constructs.length === 0 || provider !== "aws-lambda") return functionInfos;
 		const functionsDir = join(outputDir, "functions");
@@ -410,7 +412,7 @@ var FunctionGenerator = class extends ConstructGenerator {
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment()
 			});
-			logger$12.log(`Generated function handler: ${key}`);
+			logger$14.log(`Generated function handler: ${key}`);
 		}
 		return functionInfos;
 	}
@@ -443,11 +445,11 @@ var SubscriberGenerator = class extends ConstructGenerator {
 	}
 	async build(context, constructs, outputDir, options) {
 		const provider = options?.provider || "aws-lambda";
-		const logger$12 = console;
+		const logger$14 = console;
 		const subscriberInfos = [];
 		if (provider === "server") {
 			await this.generateServerSubscribersFile(outputDir, constructs);
-			logger$12.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
+			logger$14.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
 			return subscriberInfos;
 		}
 		if (constructs.length === 0) return subscriberInfos;
@@ -464,7 +466,7 @@ var SubscriberGenerator = class extends ConstructGenerator {
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment()
 			});
-			logger$12.log(`Generated subscriber handler: ${key}`);
+			logger$14.log(`Generated subscriber handler: ${key}`);
 		}
 		return subscriberInfos;
 	}
@@ -519,6 +521,7 @@ export const handler = adapter.handler;
  * - sqs://region/account-id/queue-name (SQS queue)
  * - sns://region/account-id/topic-name (SNS topic)
  * - rabbitmq://host:port/queue-name (RabbitMQ)
+ * - pgboss://user:pass@host:port/database (pg-boss / PostgreSQL)
  * - basic://in-memory (In-memory for testing)
  */
 import type { EnvironmentParser } from '@geekmidas/envkit';
@@ -630,7 +633,7 @@ export async function setupSubscribers(
 
 //#endregion
 //#region src/workspace/client-generator.ts
-const logger$10 = console;
+const logger$12 = console;
 /**
 * Get frontend apps that depend on a backend app.
 */
@@ -659,7 +662,7 @@ function countEndpoints(content) {
 * Called when the backend's .gkm/openapi.ts file changes.
 */
 async function copyClientToFrontends(workspace, backendAppName, options = {}) {
-	const log = options.silent ? () => {} : logger$10.log.bind(logger$10);
+	const log = options.silent ? () => {} : logger$12.log.bind(logger$12);
 	const results = [];
 	const backendApp = workspace.apps[backendAppName];
 	if (!backendApp || backendApp.type !== "backend") return results;
@@ -722,7 +725,7 @@ async function copyAllClients(workspace, options = {}) {
 
 //#endregion
 //#region src/dev/index.ts
-const logger$9 = console;
+const logger$11 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -773,7 +776,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$9.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$11.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -856,27 +859,27 @@ async function resolveServicePorts(workspaceRoot) {
 	const savedState = await loadPortState(workspaceRoot);
 	const dockerEnv = {};
 	const ports = {};
-	logger$9.log("\n🔌 Resolving service ports...");
+	logger$11.log("\n🔌 Resolving service ports...");
 	for (const mapping of mappings) {
 		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
 		if (containerPort !== null) {
 			ports[mapping.envVar] = containerPort;
 			dockerEnv[mapping.envVar] = String(containerPort);
-			logger$9.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
+			logger$11.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
 			continue;
 		}
 		const savedPort = savedState[mapping.envVar];
 		if (savedPort && await isPortAvailable(savedPort)) {
 			ports[mapping.envVar] = savedPort;
 			dockerEnv[mapping.envVar] = String(savedPort);
-			logger$9.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
+			logger$11.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
 			continue;
 		}
 		const resolvedPort = await findAvailablePort(mapping.defaultPort);
 		ports[mapping.envVar] = resolvedPort;
 		dockerEnv[mapping.envVar] = String(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger$9.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger$9.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
+		if (resolvedPort !== mapping.defaultPort) logger$11.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
+		else logger$11.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
 	}
 	await savePortState(workspaceRoot, ports);
 	return {
@@ -1020,7 +1023,7 @@ function getProductionConfigFromGkm(config$1) {
 async function devCommand(options) {
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appName = getAppNameFromCwd();
 	let config$1;
 	let appRoot = process.cwd();
@@ -1034,9 +1037,9 @@ async function devCommand(options) {
 		secretsRoot = appConfig.workspaceRoot;
 		workspaceAppName = appConfig.appName;
 		workspaceAppPort = appConfig.app.port;
-		logger$9.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
+		logger$11.log(`📦 Running app: ${appConfig.appName} on port ${workspaceAppPort}`);
 		if (appConfig.app.entry) {
-			logger$9.log(`📄 Using entry point: ${appConfig.app.entry}`);
+			logger$11.log(`📄 Using entry point: ${appConfig.app.entry}`);
 			return entryDevCommand({
 				...options,
 				entry: appConfig.app.entry,
@@ -1047,7 +1050,7 @@ async function devCommand(options) {
 	} catch {
 		const loadedConfig = await loadWorkspaceConfig();
 		if (loadedConfig.type === "workspace") {
-			logger$9.log("📦 Detected workspace configuration");
+			logger$11.log("📦 Detected workspace configuration");
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config$1 = loadedConfig.raw;
@@ -1055,34 +1058,34 @@ async function devCommand(options) {
 	else {
 		const loadedConfig = await loadWorkspaceConfig();
 		if (loadedConfig.type === "workspace") {
-			logger$9.log("📦 Detected workspace configuration");
+			logger$11.log("📦 Detected workspace configuration");
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config$1 = loadedConfig.raw;
 	}
 	if (config$1.env) {
 		const { loaded, missing } = loadEnvFiles(config$1.env, appRoot);
-		if (loaded.length > 0) logger$9.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$9.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (loaded.length > 0) logger$11.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$11.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const resolved = resolveProviders(config$1, { provider: "server" });
-	logger$9.log("🚀 Starting development server...");
-	logger$9.log(`Loading routes from: ${config$1.routes}`);
-	if (config$1.functions) logger$9.log(`Loading functions from: ${config$1.functions}`);
-	if (config$1.crons) logger$9.log(`Loading crons from: ${config$1.crons}`);
-	if (config$1.subscribers) logger$9.log(`Loading subscribers from: ${config$1.subscribers}`);
-	logger$9.log(`Using envParser: ${config$1.envParser}`);
+	logger$11.log("🚀 Starting development server...");
+	logger$11.log(`Loading routes from: ${config$1.routes}`);
+	if (config$1.functions) logger$11.log(`Loading functions from: ${config$1.functions}`);
+	if (config$1.crons) logger$11.log(`Loading crons from: ${config$1.crons}`);
+	if (config$1.subscribers) logger$11.log(`Loading subscribers from: ${config$1.subscribers}`);
+	logger$11.log(`Using envParser: ${config$1.envParser}`);
 	const { path: envParserPath, importPattern: envParserImportPattern } = parseModuleConfig(config$1.envParser, "envParser");
 	const { path: loggerPath, importPattern: loggerImportPattern } = parseModuleConfig(config$1.logger, "logger");
 	const telescope = normalizeTelescopeConfig(config$1.telescope);
-	if (telescope) logger$9.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$11.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = normalizeStudioConfig(config$1.studio);
-	if (studio) logger$9.log(`🗄️  Studio enabled at ${studio.path}`);
+	if (studio) logger$11.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config$1.hooks, appRoot);
-	if (hooks) logger$9.log(`🪝 Server hooks enabled from ${config$1.hooks?.server}`);
+	if (hooks) logger$11.log(`🪝 Server hooks enabled from ${config$1.hooks?.server}`);
 	const openApiConfig = resolveOpenApiConfig(config$1);
 	const enableOpenApi = openApiConfig.enabled || resolved.enableOpenApi;
-	if (enableOpenApi) logger$9.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH}`);
+	if (enableOpenApi) logger$11.log(`📄 OpenAPI output: ${OPENAPI_OUTPUT_PATH}`);
 	const buildContext = {
 		envParserPath,
 		envParserImportPattern,
@@ -1102,7 +1105,7 @@ async function devCommand(options) {
 		await mkdir(secretsDir, { recursive: true });
 		secretsJsonPath = join(secretsDir, "dev-secrets.json");
 		await writeFile(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
-		logger$9.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
+		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
 	}
 	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? false, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath);
 	await devServer.start();
@@ -1120,7 +1123,7 @@ async function devCommand(options) {
 		...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []
 	].flat().filter((p) => typeof p === "string");
 	const normalizedPatterns = watchPatterns.map((p) => p.startsWith("./") ? p.slice(2) : p);
-	logger$9.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
+	logger$11.log(`👀 Watching for changes in: ${normalizedPatterns.join(", ")}`);
 	const resolvedFiles = await fg(normalizedPatterns, {
 		cwd: appRoot,
 		absolute: false,
@@ -1130,7 +1133,7 @@ async function devCommand(options) {
 		const parts = f.split("/");
 		return parts.slice(0, -1).join("/");
 	}))];
-	logger$9.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
+	logger$11.log(`📁 Found ${resolvedFiles.length} files in ${dirsToWatch.length} directories`);
 	const watcher = chokidar.watch([...resolvedFiles, ...dirsToWatch], {
 		ignored: /(^|[/\\])\../,
 		persistent: true,
@@ -1138,27 +1141,27 @@ async function devCommand(options) {
 		cwd: appRoot
 	});
 	watcher.on("ready", () => {
-		logger$9.log("🔍 File watcher ready");
+		logger$11.log("🔍 File watcher ready");
 	});
 	watcher.on("error", (error) => {
-		logger$9.error("❌ Watcher error:", error);
+		logger$11.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$9.log(`📝 File changed: ${path}`);
+		logger$11.log(`📝 File changed: ${path}`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
-				logger$9.log("🔄 Rebuilding...");
+				logger$11.log("🔄 Rebuilding...");
 				await buildServer(config$1, buildContext, resolved.providers[0], enableOpenApi, appRoot, true);
 				if (enableOpenApi) await generateOpenApi(config$1, {
 					silent: true,
 					bustCache: true
 				});
-				logger$9.log("✅ Rebuild complete, restarting server...");
+				logger$11.log("✅ Rebuild complete, restarting server...");
 				await devServer.restart();
 			} catch (error) {
-				logger$9.error("❌ Rebuild failed:", error.message);
+				logger$11.error("❌ Rebuild failed:", error.message);
 			}
 		}, 300);
 	});
@@ -1166,9 +1169,9 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$9.log("\n🛑 Shutting down...");
+		logger$11.log("\n🛑 Shutting down...");
 		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
-			logger$9.error("Error during shutdown:", err);
+			logger$11.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -1271,11 +1274,11 @@ async function loadDevSecrets(workspace) {
 	for (const stage of stages) if (secretsExist(stage, workspace.root)) {
 		const secrets = await readStageSecrets(stage, workspace.root);
 		if (secrets) {
-			logger$9.log(`🔐 Loading secrets from stage: ${stage}`);
+			logger$11.log(`🔐 Loading secrets from stage: ${stage}`);
 			return toEmbeddableSecrets(secrets);
 		}
 	}
-	logger$9.warn("⚠️  Secrets enabled but no dev/development secrets found. Run \"gkm secrets:init --stage dev\"");
+	logger$11.warn("⚠️  Secrets enabled but no dev/development secrets found. Run \"gkm setup\" to initialize your development environment");
 	return {};
 }
 /**
@@ -1290,7 +1293,7 @@ async function loadSecretsForApp(secretsRoot, appName) {
 	for (const stage of stages) if (secretsExist(stage, secretsRoot)) {
 		const stageSecrets = await readStageSecrets(stage, secretsRoot);
 		if (stageSecrets) {
-			logger$9.log(`🔐 Loading secrets from stage: ${stage}`);
+			logger$11.log(`🔐 Loading secrets from stage: ${stage}`);
 			secrets = toEmbeddableSecrets(stageSecrets);
 			break;
 		}
@@ -1315,11 +1318,11 @@ async function startWorkspaceServices(workspace, portEnv) {
 	if (services.cache) servicesToStart.push("redis");
 	if (services.mail) servicesToStart.push("mailpit");
 	if (servicesToStart.length === 0) return;
-	logger$9.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
+	logger$11.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
 	try {
 		const composeFile = join(workspace.root, "docker-compose.yml");
 		if (!existsSync(composeFile)) {
-			logger$9.warn("⚠️  No docker-compose.yml found. Services will not be started.");
+			logger$11.warn("⚠️  No docker-compose.yml found. Services will not be started.");
 			return;
 		}
 		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
@@ -1330,9 +1333,9 @@ async function startWorkspaceServices(workspace, portEnv) {
 				...portEnv
 			}
 		});
-		logger$9.log("✅ Services started");
+		logger$11.log("✅ Services started");
 	} catch (error) {
-		logger$9.error("❌ Failed to start services:", error.message);
+		logger$11.error("❌ Failed to start services:", error.message);
 		throw error;
 	}
 }
@@ -1349,41 +1352,41 @@ async function workspaceDevCommand(workspace, options) {
 	const appCount = Object.keys(workspace.apps).length;
 	const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend");
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "frontend");
-	logger$9.log(`\n🚀 Starting workspace: ${workspace.name}`);
-	logger$9.log(`   ${backendApps.length} backend app(s), ${frontendApps.length} frontend app(s)`);
+	logger$11.log(`\n🚀 Starting workspace: ${workspace.name}`);
+	logger$11.log(`   ${backendApps.length} backend app(s), ${frontendApps.length} frontend app(s)`);
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$9.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$11.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
-		logger$9.log("\n🔍 Validating frontend apps...");
+		logger$11.log("\n🔍 Validating frontend apps...");
 		const validationResults = await validateFrontendApps(workspace);
 		let hasErrors = false;
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$9.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$9.error(`   • ${error}`);
+				logger$11.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$11.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$9.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$11.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
-		logger$9.log("✅ Frontend apps validated");
+		logger$11.log("✅ Frontend apps validated");
 	}
 	if (frontendApps.length > 0 && backendApps.length > 0) {
 		const clientResults = await copyAllClients(workspace);
 		const copiedCount = clientResults.filter((r) => r.success).length;
-		if (copiedCount > 0) logger$9.log(`\n📦 Copied ${copiedCount} API client(s)`);
+		if (copiedCount > 0) logger$11.log(`\n📦 Copied ${copiedCount} API client(s)`);
 	}
 	const resolvedPorts = await resolveServicePorts(workspace.root);
 	await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
 	const secretsEnv = rewriteUrlsWithPorts(await loadDevSecrets(workspace), resolvedPorts);
-	if (Object.keys(secretsEnv).length > 0) logger$9.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
+	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
 	const dependencyEnv = generateAllDependencyEnvVars(workspace);
 	if (Object.keys(dependencyEnv).length > 0) {
-		logger$9.log("📡 Dependency URLs:");
-		for (const [key, value] of Object.entries(dependencyEnv)) logger$9.log(`   ${key}=${value}`);
+		logger$11.log("📡 Dependency URLs:");
+		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
 	}
 	let turboFilter = [];
 	if (options.app) {
@@ -1392,18 +1395,18 @@ async function workspaceDevCommand(workspace, options) {
 			throw new Error(`App "${options.app}" not found. Available apps: ${appNames}`);
 		}
 		turboFilter = ["--filter", options.app];
-		logger$9.log(`\n🎯 Running single app: ${options.app}`);
+		logger$11.log(`\n🎯 Running single app: ${options.app}`);
 	} else if (options.filter) {
 		turboFilter = ["--filter", options.filter];
-		logger$9.log(`\n🔍 Using filter: ${options.filter}`);
-	} else logger$9.log(`\n🎯 Running all ${appCount} apps`);
+		logger$11.log(`\n🔍 Using filter: ${options.filter}`);
+	} else logger$11.log(`\n🎯 Running all ${appCount} apps`);
 	const buildOrder = getAppBuildOrder(workspace);
-	logger$9.log("\n📋 Apps (in dependency order):");
+	logger$11.log("\n📋 Apps (in dependency order):");
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
 		const deps = app.dependencies.length > 0 ? ` (depends on: ${app.dependencies.join(", ")})` : "";
-		logger$9.log(`   ${app.type === "backend" ? "🔧" : "🌐"} ${appName} → http://localhost:${app.port}${deps}`);
+		logger$11.log(`   ${app.type === "backend" ? "🔧" : "🌐"} ${appName} → http://localhost:${app.port}${deps}`);
 	}
 	const configFiles = [
 		"gkm.config.ts",
@@ -1425,7 +1428,7 @@ async function workspaceDevCommand(workspace, options) {
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
 	};
-	logger$9.log("\n🏃 Starting turbo run dev...\n");
+	logger$11.log("\n🏃 Starting turbo run dev...\n");
 	const turboProcess = spawn("pnpm", [
 		"turbo",
 		"run",
@@ -1447,7 +1450,7 @@ async function workspaceDevCommand(workspace, options) {
 			});
 		}
 		if (openApiPaths.length > 0) {
-			logger$9.log(`\n👀 Watching ${openApiPaths.length} backend OpenAPI spec(s) for changes`);
+			logger$11.log(`\n👀 Watching ${openApiPaths.length} backend OpenAPI spec(s) for changes`);
 			const pathToApp = new Map(openApiPaths.map((p) => [p.path, p.appName]));
 			openApiWatcher = chokidar.watch(openApiPaths.map((p) => p.path), {
 				persistent: true,
@@ -1460,13 +1463,13 @@ async function workspaceDevCommand(workspace, options) {
 				copyTimeout = setTimeout(async () => {
 					const backendAppName = pathToApp.get(changedPath);
 					if (!backendAppName) return;
-					logger$9.log(`\n🔄 OpenAPI spec changed for ${backendAppName}`);
+					logger$11.log(`\n🔄 OpenAPI spec changed for ${backendAppName}`);
 					try {
 						const results = await copyClientToFrontends(workspace, backendAppName, { silent: true });
-						for (const result of results) if (result.success) logger$9.log(`   📦 Copied client to ${result.frontendApp} (${result.endpointCount} endpoints)`);
-						else if (result.error) logger$9.error(`   ❌ Failed to copy client to ${result.frontendApp}: ${result.error}`);
+						for (const result of results) if (result.success) logger$11.log(`   📦 Copied client to ${result.frontendApp} (${result.endpointCount} endpoints)`);
+						else if (result.error) logger$11.error(`   ❌ Failed to copy client to ${result.frontendApp}: ${result.error}`);
 					} catch (error) {
-						logger$9.error(`   ❌ Failed to copy clients: ${error.message}`);
+						logger$11.error(`   ❌ Failed to copy clients: ${error.message}`);
 					}
 				}, 200);
 			};
@@ -1478,7 +1481,7 @@ async function workspaceDevCommand(workspace, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$9.log("\n🛑 Shutting down workspace...");
+		logger$11.log("\n🛑 Shutting down workspace...");
 		if (openApiWatcher) openApiWatcher.close().catch(() => {});
 		if (turboProcess.pid) try {
 			process.kill(-turboProcess.pid, "SIGTERM");
@@ -1493,7 +1496,7 @@ async function workspaceDevCommand(workspace, options) {
 	process.on("SIGTERM", shutdown);
 	return new Promise((resolve$1, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$9.error("❌ Turbo error:", error);
+			logger$11.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
@@ -1606,7 +1609,7 @@ async function prepareEntryCredentials(options) {
 		secretsRoot = appInfo.workspaceRoot;
 		appName = appInfo.appName;
 	} catch (error) {
-		logger$9.log(`⚠️  Could not load workspace config: ${error.message}`);
+		logger$11.log(`⚠️  Could not load workspace config: ${error.message}`);
 		secretsRoot = findSecretsRoot(cwd);
 		appName = getAppNameFromCwd(cwd) ?? void 0;
 	}
@@ -1636,11 +1639,11 @@ async function entryDevCommand(options) {
 	const entryPath = resolve(process.cwd(), entry);
 	if (!existsSync(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$9.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$9.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$9.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	if (appName) logger$11.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$11.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$11.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = join(process.cwd(), ".gkm");
 	await mkdir(wrapperDir, { recursive: true });
 	const wrapperPath = join(wrapperDir, "entry-wrapper.ts");
@@ -1651,7 +1654,7 @@ async function entryDevCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$9.log("\n🛑 Shutting down...");
+		logger$11.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -1683,14 +1686,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$9.log(`📝 File changed: ${path}`);
+				logger$11.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$9.log("🔄 Restarting...");
+					logger$11.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$9.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$11.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -1705,14 +1708,14 @@ var EntryRunner = class {
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$9.error("❌ Process error:", error);
+			logger$11.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$9.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$11.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve$1) => setTimeout(resolve$1, 500));
-		if (this.isRunning) logger$9.log(`\n🎉 Running at http://localhost:${this.port}`);
+		if (this.isRunning) logger$11.log(`\n🎉 Running at http://localhost:${this.port}`);
 	}
 	async restart() {
 		this.stopProcess();
@@ -1738,6 +1741,66 @@ var EntryRunner = class {
 		}
 	}
 };
+/**
+* Generate the content of the dev server entry file (server.ts).
+* Uses dynamic import for createApp so Credentials are populated
+* before any app modules evaluate.
+* @internal Exported for testing
+*/
+function generateServerEntryContent(options) {
+	const { secretsJsonPath, runtime = "node", enableOpenApi = false, appImportPath = "./app.js" } = options;
+	const credentialsInjection = secretsJsonPath ? `import { Credentials } from '@geekmidas/envkit/credentials';
+import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets into Credentials (must happen before app import)
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  Object.assign(Credentials, JSON.parse(readFileSync(secretsPath, 'utf-8')));
+}
+
+` : "";
+	const serveCode = runtime === "bun" ? `Bun.serve({
+      port,
+      fetch: app.fetch,
+    });` : `const { serve } = await import('@hono/node-server');
+    const server = serve({
+      fetch: app.fetch,
+      port,
+    });
+    // Inject WebSocket support if available
+    const injectWs = (app as any).__injectWebSocket;
+    if (injectWs) {
+      injectWs(server);
+      console.log('🔌 Telescope real-time updates enabled');
+    }`;
+	return `#!/usr/bin/env node
+/**
+ * Development server entry point
+ * This file is auto-generated by 'gkm dev'
+ */
+${credentialsInjection}
+const port = process.argv.includes('--port')
+  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
+  : 3000;
+
+// Dynamic import so Credentials are populated before env.ts evaluates
+const { createApp } = await import('${appImportPath}');
+
+// createApp is async to support optional WebSocket setup
+const { app, start } = await createApp(undefined, ${enableOpenApi});
+
+// Start the server
+start({
+  port,
+  serve: async (app, port) => {
+    ${serveCode}
+  },
+}).catch((error) => {
+  console.error('Failed to start server:', error);
+  process.exit(1);
+});
+`;
+}
 var DevServer = class {
 	serverProcess = null;
 	isRunning = false;
@@ -1762,11 +1825,11 @@ var DevServer = class {
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$9.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			if (this.actualPort !== this.requestedPort) logger$11.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = join(this.appRoot, ".gkm", this.provider, "server.ts");
 		await this.createServerEntry();
-		logger$9.log(`\n✨ Starting server on port ${this.actualPort}...`);
+		logger$11.log(`\n✨ Starting server on port ${this.actualPort}...`);
 		this.serverProcess = spawn("npx", [
 			"tsx",
 			serverEntryPath,
@@ -1782,18 +1845,18 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$9.error("❌ Server error:", error);
+			logger$11.error("❌ Server error:", error);
 		});
 		this.serverProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$9.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$11.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve$1) => setTimeout(resolve$1, 1e3));
 		if (this.isRunning) {
-			logger$9.log(`\n🎉 Server running at http://localhost:${this.actualPort}`);
-			if (this.enableOpenApi) logger$9.log(`📚 API Docs available at http://localhost:${this.actualPort}/__docs`);
-			if (this.telescope) logger$9.log(`🔭 Telescope available at http://localhost:${this.actualPort}${this.telescope.path}`);
-			if (this.studio) logger$9.log(`🗄️  Studio available at http://localhost:${this.actualPort}${this.studio.path}`);
+			logger$11.log(`\n🎉 Server running at http://localhost:${this.actualPort}`);
+			if (this.enableOpenApi) logger$11.log(`📚 API Docs available at http://localhost:${this.actualPort}/__docs`);
+			if (this.telescope) logger$11.log(`🔭 Telescope available at http://localhost:${this.actualPort}${this.telescope.path}`);
+			if (this.studio) logger$11.log(`🗄️  Studio available at http://localhost:${this.actualPort}${this.studio.path}`);
 		}
 	}
 	async stop() {
@@ -1831,58 +1894,12 @@ var DevServer = class {
 	}
 	async createServerEntry() {
 		const { writeFile: fsWriteFile } = await import("node:fs/promises");
-		const { relative: relative$1, dirname: dirname$1 } = await import("node:path");
 		const serverPath = join(this.appRoot, ".gkm", this.provider, "server.ts");
-		const relativeAppPath = relative$1(dirname$1(serverPath), join(dirname$1(serverPath), "app.js"));
-		const credentialsInjection = this.secretsJsonPath ? `import { Credentials } from '@geekmidas/envkit/credentials';
-import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets into Credentials (must happen before app import)
-const secretsPath = '${this.secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  Object.assign(Credentials, JSON.parse(readFileSync(secretsPath, 'utf-8')));
-}
-
-` : "";
-		const serveCode = this.runtime === "bun" ? `Bun.serve({
-      port,
-      fetch: app.fetch,
-    });` : `const { serve } = await import('@hono/node-server');
-    const server = serve({
-      fetch: app.fetch,
-      port,
-    });
-    // Inject WebSocket support if available
-    const injectWs = (app as any).__injectWebSocket;
-    if (injectWs) {
-      injectWs(server);
-      console.log('🔌 Telescope real-time updates enabled');
-    }`;
-		const content = `#!/usr/bin/env node
-/**
- * Development server entry point
- * This file is auto-generated by 'gkm dev'
- */
-${credentialsInjection}import { createApp } from './${relativeAppPath.startsWith(".") ? relativeAppPath : `./${relativeAppPath}`}';
-
-const port = process.argv.includes('--port')
-  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
-  : 3000;
-
-// createApp is async to support optional WebSocket setup
-const { app, start } = await createApp(undefined, ${this.enableOpenApi});
-
-// Start the server
-start({
-  port,
-  serve: async (app, port) => {
-    ${serveCode}
-  },
-}).catch((error) => {
-  console.error('Failed to start server:', error);
-  process.exit(1);
-});
-`;
+		const content = generateServerEntryContent({
+			secretsJsonPath: this.secretsJsonPath,
+			runtime: this.runtime,
+			enableOpenApi: this.enableOpenApi
+		});
 		await fsWriteFile(serverPath, content);
 	}
 };
@@ -1901,11 +1918,11 @@ async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (commandArgs.length === 0) throw new Error("No command specified. Usage: gkm exec -- <command>");
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, secretsJsonPath, appName, secretsRoot } = await prepareEntryCredentials({ cwd });
-	if (appName) logger$9.log(`📦 App: ${appName}`);
+	if (appName) logger$11.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$9.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$11.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const composePath = join(secretsRoot, "docker-compose.yml");
 	const mappings = parseComposePortMappings(composePath);
 	if (mappings.length > 0) {
@@ -1917,7 +1934,7 @@ async function execCommand(commandArgs, options = {}) {
 				mappings
 			});
 			Object.assign(credentials, rewritten);
-			logger$9.log(`🔌 Applied ${Object.keys(ports).length} port mapping(s)`);
+			logger$11.log(`🔌 Applied ${Object.keys(ports).length} port mapping(s)`);
 		}
 	}
 	try {
@@ -1934,7 +1951,7 @@ async function execCommand(commandArgs, options = {}) {
 	const [cmd, ...rawArgs] = commandArgs;
 	if (!cmd) throw new Error("No command specified");
 	const args = rawArgs.map((arg) => arg.replace(/\$PORT\b/g, credentials.PORT ?? "3000"));
-	logger$9.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$11.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const existingNodeOptions = process.env.NODE_OPTIONS ?? "";
 	const tsxImport = "--import=tsx";
 	const preloadImport = `--import=${preloadPath}`;
@@ -1955,7 +1972,7 @@ async function execCommand(commandArgs, options = {}) {
 	const exitCode = await new Promise((resolve$1) => {
 		child.on("close", (code) => resolve$1(code ?? 0));
 		child.on("error", (error) => {
-			logger$9.error(`Failed to run command: ${error.message}`);
+			logger$11.error(`Failed to run command: ${error.message}`);
 			resolve$1(1);
 		});
 	});
@@ -1964,7 +1981,7 @@ async function execCommand(commandArgs, options = {}) {
 
 //#endregion
 //#region src/build/manifests.ts
-const logger$8 = console;
+const logger$10 = console;
 async function generateAwsManifest(outputDir, routes, functions, crons, subscribers) {
 	const manifestDir = join(outputDir, "manifest");
 	await mkdir(manifestDir, { recursive: true });
@@ -1989,8 +2006,8 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = join(manifestDir, "aws.ts");
 	await writeFile(manifestPath, content);
-	logger$8.log(`Generated AWS manifest with ${awsRoutes.length} routes, ${functions.length} functions, ${crons.length} crons, ${subscribers.length} subscribers`);
-	logger$8.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
+	logger$10.log(`Generated AWS manifest with ${awsRoutes.length} routes, ${functions.length} functions, ${crons.length} crons, ${subscribers.length} subscribers`);
+	logger$10.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
 }
 async function generateServerManifest(outputDir, appInfo, routes, subscribers) {
 	const manifestDir = join(outputDir, "manifest");
@@ -2021,13 +2038,13 @@ export type RoutePath = Route['path'];
 `;
 	const manifestPath = join(manifestDir, "server.ts");
 	await writeFile(manifestPath, content);
-	logger$8.log(`Generated server manifest with ${serverRoutes.length} routes, ${serverSubscribers.length} subscribers`);
-	logger$8.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
+	logger$10.log(`Generated server manifest with ${serverRoutes.length} routes, ${serverSubscribers.length} subscribers`);
+	logger$10.log(`Manifest: ${relative(process.cwd(), manifestPath)}`);
 }
 
 //#endregion
 //#region src/build/index.ts
-const logger$7 = console;
+const logger$9 = console;
 async function buildCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
@@ -2035,7 +2052,7 @@ async function buildCommand(options) {
 		const workspaceRoot = resolve(loadedConfig.workspace.root);
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
 		if (isAtWorkspaceRoot) {
-			logger$7.log("📦 Detected workspace configuration");
+			logger$9.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
@@ -2043,21 +2060,21 @@ async function buildCommand(options) {
 	const resolved = resolveProviders(config$1, options);
 	const productionConfigFromGkm = getProductionConfigFromGkm(config$1);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
-	if (production) logger$7.log(`🏭 Building for PRODUCTION`);
-	logger$7.log(`Building with providers: ${resolved.providers.join(", ")}`);
-	logger$7.log(`Loading routes from: ${config$1.routes}`);
-	if (config$1.functions) logger$7.log(`Loading functions from: ${config$1.functions}`);
-	if (config$1.crons) logger$7.log(`Loading crons from: ${config$1.crons}`);
-	if (config$1.subscribers) logger$7.log(`Loading subscribers from: ${config$1.subscribers}`);
-	logger$7.log(`Using envParser: ${config$1.envParser}`);
+	if (production) logger$9.log(`🏭 Building for PRODUCTION`);
+	logger$9.log(`Building with providers: ${resolved.providers.join(", ")}`);
+	logger$9.log(`Loading routes from: ${config$1.routes}`);
+	if (config$1.functions) logger$9.log(`Loading functions from: ${config$1.functions}`);
+	if (config$1.crons) logger$9.log(`Loading crons from: ${config$1.crons}`);
+	if (config$1.subscribers) logger$9.log(`Loading subscribers from: ${config$1.subscribers}`);
+	logger$9.log(`Using envParser: ${config$1.envParser}`);
 	const { path: envParserPath, importPattern: envParserImportPattern } = parseModuleConfig(config$1.envParser, "envParser");
 	const { path: loggerPath, importPattern: loggerImportPattern } = parseModuleConfig(config$1.logger, "logger");
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config$1.telescope);
-	if (telescope) logger$7.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$9.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = production ? void 0 : normalizeStudioConfig(config$1.studio);
-	if (studio) logger$7.log(`🗄️  Studio enabled at ${studio.path}`);
+	if (studio) logger$9.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config$1.hooks);
-	if (hooks) logger$7.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$9.log(`🪝 Server hooks enabled`);
 	const services = config$1.docker?.compose?.services;
 	const dockerServices = services ? Array.isArray(services) ? {
 		postgres: services.includes("postgres"),
@@ -2089,12 +2106,12 @@ async function buildCommand(options) {
 		config$1.crons ? cronGenerator.load(config$1.crons) : [],
 		config$1.subscribers ? subscriberGenerator.load(config$1.subscribers) : []
 	]);
-	logger$7.log(`Found ${allEndpoints.length} endpoints`);
-	logger$7.log(`Found ${allFunctions.length} functions`);
-	logger$7.log(`Found ${allCrons.length} crons`);
-	logger$7.log(`Found ${allSubscribers.length} subscribers`);
+	logger$9.log(`Found ${allEndpoints.length} endpoints`);
+	logger$9.log(`Found ${allFunctions.length} functions`);
+	logger$9.log(`Found ${allCrons.length} crons`);
+	logger$9.log(`Found ${allSubscribers.length} subscribers`);
 	if (allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0) {
-		logger$7.log("No endpoints, functions, crons, or subscribers found to process");
+		logger$9.log("No endpoints, functions, crons, or subscribers found to process");
 		return {};
 	}
 	const rootOutputDir = join(process.cwd(), ".gkm");
@@ -2109,7 +2126,7 @@ async function buildCommand(options) {
 async function buildForProvider(provider, context, rootOutputDir, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, endpoints, functions, crons, subscribers, enableOpenApi, skipBundle, stage) {
 	const outputDir = join(process.cwd(), ".gkm", provider);
 	await mkdir(outputDir, { recursive: true });
-	logger$7.log(`\nGenerating handlers for provider: ${provider}`);
+	logger$9.log(`\nGenerating handlers for provider: ${provider}`);
 	const [routes, functionInfos, cronInfos, subscriberInfos] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
 			provider,
@@ -2119,7 +2136,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		cronGenerator.build(context, crons, outputDir, { provider }),
 		subscriberGenerator.build(context, subscribers, outputDir, { provider })
 	]);
-	logger$7.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
+	logger$9.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers for ${provider}`);
 	if (provider === "server") {
 		const routeMetadata = await Promise.all(endpoints.map(async ({ construct }) => ({
 			path: construct._path,
@@ -2134,8 +2151,8 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		await generateServerManifest(rootOutputDir, appInfo, routeMetadata, subscriberInfos);
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
-			logger$7.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-DgXsOSxc.mjs");
+			logger$9.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await import("./bundler-DQYjKFPm.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2154,10 +2171,10 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 				dockerServices
 			});
 			masterKey = bundleResult.masterKey;
-			logger$7.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$9.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
-				logger$7.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$7.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
+				logger$9.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$9.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
 			}
 		}
 		return { masterKey };
@@ -2194,17 +2211,17 @@ async function workspaceBuildCommand(workspace, options) {
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
 	const frontendApps = apps.filter(([, app]) => app.type === "frontend");
-	logger$7.log(`\n🏗️  Building workspace: ${workspace.name}`);
-	logger$7.log(`   Backend apps: ${backendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
-	logger$7.log(`   Frontend apps: ${frontendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
-	if (options.production) logger$7.log(`   🏭 Production mode enabled`);
+	logger$9.log(`\n🏗️  Building workspace: ${workspace.name}`);
+	logger$9.log(`   Backend apps: ${backendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
+	logger$9.log(`   Frontend apps: ${frontendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
+	if (options.production) logger$9.log(`   🏭 Production mode enabled`);
 	const buildOrder = getAppBuildOrder(workspace);
-	logger$7.log(`   Build order: ${buildOrder.join(" → ")}`);
+	logger$9.log(`   Build order: ${buildOrder.join(" → ")}`);
 	const pm = detectPackageManager$2();
-	logger$7.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
+	logger$9.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
 	try {
 		const turboCommand = getTurboCommand(pm);
-		logger$7.log(`Running: ${turboCommand}`);
+		logger$9.log(`Running: ${turboCommand}`);
 		await new Promise((resolve$1, reject) => {
 			const child = spawn(turboCommand, {
 				shell: true,
@@ -2232,15 +2249,15 @@ async function workspaceBuildCommand(workspace, options) {
 				outputPath
 			});
 		}
-		logger$7.log(`\n✅ Workspace build complete!`);
-		logger$7.log(`\n📋 Build Summary:`);
+		logger$9.log(`\n✅ Workspace build complete!`);
+		logger$9.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : "🌐";
-			logger$7.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
+			logger$9.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : "Build failed";
-		logger$7.log(`\n❌ Build failed: ${errorMessage}`);
+		logger$9.log(`\n❌ Build failed: ${errorMessage}`);
 		for (const [appName, app] of apps) results.push({
 			appName,
 			type: app.type,
@@ -2414,11 +2431,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-402UdK89.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-ANWchdiK.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-DbBo7Uz5.mjs");
+		const { Route53Provider } = await import("./Route53Provider-QoPgcXxn.mjs");
 		const route53Config = config$1;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -2432,7 +2449,7 @@ async function createDnsProvider(options) {
 
 //#endregion
 //#region src/deploy/dns/index.ts
-const logger$6 = console;
+const logger$8 = console;
 /**
 * Check if DNS config is legacy format (single domain with `domain` property)
 */
@@ -2469,7 +2486,7 @@ function groupHostnamesByDomain(appHostnames, dnsConfig) {
 	for (const [appName, hostname] of appHostnames) {
 		const rootDomain = findRootDomain(hostname, dnsConfig);
 		if (!rootDomain) {
-			logger$6.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			logger$8.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
 			continue;
 		}
 		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
@@ -2521,10 +2538,10 @@ function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
 * Print DNS records table
 */
 function printDnsRecordsTable(records, rootDomain) {
-	logger$6.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$6.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$6.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$6.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	logger$8.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$8.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$8.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$8.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
 	for (const record of records) {
 		const subdomain = record.subdomain.padEnd(35);
 		const type$1 = record.type.padEnd(4);
@@ -2534,18 +2551,18 @@ function printDnsRecordsTable(records, rootDomain) {
 		else if (record.created) status = "✓ new";
 		else if (record.existed) status = "✓";
 		else status = "?";
-		logger$6.log(`   │ ${subdomain} │ ${type$1} │ ${value} │ ${status.padEnd(6)} │`);
+		logger$8.log(`   │ ${subdomain} │ ${type$1} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	logger$6.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+	logger$8.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
 * Print DNS records in a simple format for manual setup
 */
 function printDnsRecordsSimple(records, rootDomain) {
-	logger$6.log("\n   📋 Required DNS Records:");
-	logger$6.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$6.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$6.log("");
+	logger$8.log("\n   📋 Required DNS Records:");
+	logger$8.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$8.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$8.log("");
 }
 /**
 * Create DNS records for a single domain using its configured provider
@@ -2557,7 +2574,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		provider = await createDnsProvider({ config: providerConfig });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$6.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		logger$8.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			...r,
 			error: message
@@ -2611,7 +2628,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$6.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		logger$8.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			hostname: r.hostname,
 			subdomain: r.subdomain,
@@ -2638,20 +2655,20 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$6.log("\n🌐 Setting up DNS records...");
+	logger$8.log("\n🌐 Setting up DNS records...");
 	let serverIp;
 	try {
 		const endpointUrl = new URL(dokployEndpoint);
 		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$6.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+		logger$8.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$6.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		logger$8.log(`   ⚠ Failed to resolve server IP: ${message}`);
 		return null;
 	}
 	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
 	if (groupedHostnames.size === 0) {
-		logger$6.log("   No DNS records needed (no hostnames match configured domains)");
+		logger$8.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
 			records: [],
 			success: true,
@@ -2663,22 +2680,22 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	for (const [rootDomain, domainHostnames] of groupedHostnames) {
 		const providerConfig = normalizedConfig[rootDomain];
 		if (!providerConfig) {
-			logger$6.log(`   ⚠ No provider config for ${rootDomain}`);
+			logger$8.log(`   ⚠ No provider config for ${rootDomain}`);
 			continue;
 		}
 		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
 		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
 		if (requiredRecords.length === 0) continue;
-		logger$6.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		logger$8.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
 		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
 		allRecords.push(...domainRecords);
 		const created = domainRecords.filter((r) => r.created).length;
 		const existed = domainRecords.filter((r) => r.existed).length;
 		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$6.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$6.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (created > 0) logger$8.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$8.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
 		if (failed > 0) {
-			logger$6.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			logger$8.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
 		if (state) {
@@ -2715,10 +2732,10 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 */
 async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
-	logger$6.log("\n🔍 Verifying DNS records...");
+	logger$8.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
 		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$6.log(`   ✓ ${hostname} (previously verified)`);
+			logger$8.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
 				appName,
@@ -2732,7 +2749,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
 				setDnsVerification(state, hostname, serverIp);
-				logger$6.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				logger$8.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -2741,7 +2758,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 					expectedIp: serverIp
 				});
 			} else {
-				logger$6.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				logger$8.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -2752,7 +2769,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$6.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			logger$8.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
 			results.push({
 				hostname,
 				appName,
@@ -2766,9 +2783,9 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const skipped = results.filter((r) => r.skipped).length;
 	const pending = results.filter((r) => !r.verified).length;
 	if (pending > 0) {
-		logger$6.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$6.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$6.log(`   ${verified} verified (${skipped} from cache)`);
+		logger$8.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$8.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$8.log(`   ${verified} verified (${skipped} from cache)`);
 	return results;
 }
 
@@ -3844,7 +3861,7 @@ CMD ["node", "index.mjs"]
 
 //#endregion
 //#region src/docker/index.ts
-const logger$5 = console;
+const logger$7 = console;
 /**
 * Docker command implementation
 * Generates Dockerfile, docker-compose.yml, and related files
@@ -3855,7 +3872,7 @@ const logger$5 = console;
 async function dockerCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$5.log("📦 Detected workspace configuration");
+		logger$7.log("📦 Detected workspace configuration");
 		return workspaceDockerCommand(loadedConfig.workspace, options);
 	}
 	const config$1 = await loadConfig();
@@ -3876,14 +3893,14 @@ async function dockerCommand(options) {
 	let useTurbo = options.turbo ?? false;
 	if (inMonorepo && !useSlim) if (hasTurbo) {
 		useTurbo = true;
-		logger$5.log("   Detected monorepo with turbo.json - using turbo prune");
+		logger$7.log("   Detected monorepo with turbo.json - using turbo prune");
 	} else throw new Error("Monorepo detected but turbo.json not found.\n\nDocker builds in monorepos require Turborepo for proper dependency isolation.\n\nTo fix this:\n  1. Install turbo: pnpm add -Dw turbo\n  2. Create turbo.json in your monorepo root\n  3. Run this command again\n\nSee: https://turbo.build/repo/docs/guides/tools/docker");
 	let turboPackage = options.turboPackage ?? dockerConfig.imageName;
 	if (useTurbo && !options.turboPackage) try {
 		const pkg$1 = __require(`${process.cwd()}/package.json`);
 		if (pkg$1.name) {
 			turboPackage = pkg$1.name;
-			logger$5.log(`   Turbo package: ${turboPackage}`);
+			logger$7.log(`   Turbo package: ${turboPackage}`);
 		}
 	} catch {}
 	const templateOptions = {
@@ -3900,7 +3917,7 @@ async function dockerCommand(options) {
 	const dockerMode = useSlim ? "slim" : useTurbo ? "turbo" : "multi-stage";
 	const dockerfilePath = join(dockerDir, "Dockerfile");
 	await writeFile(dockerfilePath, dockerfile);
-	logger$5.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
+	logger$7.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
 	const composeOptions = {
 		imageName: dockerConfig.imageName,
 		registry: options.registry ?? dockerConfig.registry,
@@ -3912,15 +3929,15 @@ async function dockerCommand(options) {
 	const dockerCompose = hasServices ? generateDockerCompose(composeOptions) : generateMinimalDockerCompose(composeOptions);
 	const composePath = join(dockerDir, "docker-compose.yml");
 	await writeFile(composePath, dockerCompose);
-	logger$5.log("Generated: .gkm/docker/docker-compose.yml");
+	logger$7.log("Generated: .gkm/docker/docker-compose.yml");
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = join(process.cwd(), ".dockerignore");
 	await writeFile(dockerignorePath, dockerignore);
-	logger$5.log("Generated: .dockerignore (project root)");
+	logger$7.log("Generated: .dockerignore (project root)");
 	const entrypoint = generateDockerEntrypoint();
 	const entrypointPath = join(dockerDir, "docker-entrypoint.sh");
 	await writeFile(entrypointPath, entrypoint);
-	logger$5.log("Generated: .gkm/docker/docker-entrypoint.sh");
+	logger$7.log("Generated: .gkm/docker/docker-entrypoint.sh");
 	const result = {
 		dockerfile: dockerfilePath,
 		dockerCompose: composePath,
@@ -3939,13 +3956,13 @@ async function dockerCommand(options) {
 function ensureLockfile(cwd) {
 	const lockfilePath = findLockfilePath(cwd);
 	if (!lockfilePath) {
-		logger$5.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
+		logger$7.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
 		return null;
 	}
 	const lockfileName = basename(lockfilePath);
 	const localLockfile = join(cwd, lockfileName);
 	if (lockfilePath === localLockfile) return null;
-	logger$5.log(`   Copying ${lockfileName} from monorepo root...`);
+	logger$7.log(`   Copying ${lockfileName} from monorepo root...`);
 	copyFileSync(lockfilePath, localLockfile);
 	return () => {
 		try {
@@ -3961,7 +3978,7 @@ async function buildDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
-	logger$5.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger$7.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cwd = process.cwd();
 	const cleanup = ensureLockfile(cwd);
 	try {
@@ -3973,7 +3990,7 @@ async function buildDockerImage(imageName, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$5.log(`✅ Docker image built: ${fullImageName}`);
+		logger$7.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	} finally {
@@ -3988,13 +4005,13 @@ async function pushDockerImage(imageName, options) {
 	const registry = options.registry;
 	if (!registry) throw new Error("Registry is required to push Docker image. Use --registry or configure docker.registry in gkm.config.ts");
 	const fullImageName = `${registry}/${imageName}:${tag}`;
-	logger$5.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger$7.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		execSync(`docker push ${fullImageName}`, {
 			cwd: process.cwd(),
 			stdio: "inherit"
 		});
-		logger$5.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger$7.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -4020,11 +4037,11 @@ function getAppPackageName(appPath) {
 async function workspaceDockerCommand(workspace, options) {
 	const results = [];
 	const apps = Object.entries(workspace.apps);
-	logger$5.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger$7.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
 	const dockerDir = join(workspace.root, ".gkm", "docker");
 	await mkdir(dockerDir, { recursive: true });
 	const packageManager = detectPackageManager$1(workspace.root);
-	logger$5.log(`   Package manager: ${packageManager}`);
+	logger$7.log(`   Package manager: ${packageManager}`);
 	for (const [appName, app] of apps) {
 		const appPath = app.path;
 		const fullAppPath = join(workspace.root, appPath);
@@ -4032,7 +4049,7 @@ async function workspaceDockerCommand(workspace, options) {
 		const imageName = appName;
 		const hasEntry = !!app.entry;
 		const buildType = hasEntry ? "entry" : app.type;
-		logger$5.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger$7.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		let dockerfile;
 		if (app.type === "frontend") dockerfile = generateNextjsDockerfile({
 			imageName,
@@ -4063,7 +4080,7 @@ async function workspaceDockerCommand(workspace, options) {
 		});
 		const dockerfilePath = join(dockerDir, `Dockerfile.${appName}`);
 		await writeFile(dockerfilePath, dockerfile);
-		logger$5.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
+		logger$7.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -4074,19 +4091,19 @@ async function workspaceDockerCommand(workspace, options) {
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = join(workspace.root, ".dockerignore");
 	await writeFile(dockerignorePath, dockerignore);
-	logger$5.log(`\n   Generated: .dockerignore (workspace root)`);
+	logger$7.log(`\n   Generated: .dockerignore (workspace root)`);
 	const dockerCompose = generateWorkspaceCompose(workspace, { registry: options.registry });
 	const composePath = join(dockerDir, "docker-compose.yml");
 	await writeFile(composePath, dockerCompose);
-	logger$5.log(`   Generated: .gkm/docker/docker-compose.yml`);
-	logger$5.log(`\n✅ Generated ${results.length} Dockerfile(s) + docker-compose.yml`);
-	logger$5.log("\n📋 Build commands:");
+	logger$7.log(`   Generated: .gkm/docker/docker-compose.yml`);
+	logger$7.log(`\n✅ Generated ${results.length} Dockerfile(s) + docker-compose.yml`);
+	logger$7.log("\n📋 Build commands:");
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : "🌐";
-		logger$5.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
+		logger$7.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
 	}
-	logger$5.log("\n📋 Run all services:");
-	logger$5.log("   docker compose -f .gkm/docker/docker-compose.yml up --build");
+	logger$7.log("\n📋 Run all services:");
+	logger$7.log("   docker compose -f .gkm/docker/docker-compose.yml up --build");
 	return {
 		apps: results,
 		dockerCompose: composePath,
@@ -4126,7 +4143,7 @@ function getAppNameFromPackageJson() {
 	} catch {}
 	return void 0;
 }
-const logger$4 = console;
+const logger$6 = console;
 /**
 * Get the full image reference
 */
@@ -4141,18 +4158,18 @@ function getImageRef(registry, imageName, tag) {
 * @param buildArgs - Build arguments to pass to docker build
 */
 async function buildImage(imageRef, appName, buildArgs) {
-	logger$4.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$6.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
 	const lockfilePath = findLockfilePath(cwd);
 	const lockfileDir = lockfilePath ? dirname(lockfilePath) : cwd;
 	const inMonorepo = lockfileDir !== cwd;
-	if (appName || inMonorepo) logger$4.log("   Generating Dockerfile for monorepo (turbo prune)...");
-	else logger$4.log("   Generating Dockerfile...");
+	if (appName || inMonorepo) logger$6.log("   Generating Dockerfile for monorepo (turbo prune)...");
+	else logger$6.log("   Generating Dockerfile...");
 	await dockerCommand({});
 	const dockerfileSuffix = appName ? `.${appName}` : "";
 	const dockerfilePath = `.gkm/docker/Dockerfile${dockerfileSuffix}`;
 	const buildCwd = lockfilePath && (inMonorepo || appName) ? lockfileDir : cwd;
-	if (buildCwd !== cwd) logger$4.log(`   Building from workspace root: ${buildCwd}`);
+	if (buildCwd !== cwd) logger$6.log(`   Building from workspace root: ${buildCwd}`);
 	const buildArgsString = buildArgs && buildArgs.length > 0 ? buildArgs.map((arg) => `--build-arg "${arg}"`).join(" ") : "";
 	try {
 		const cmd = [
@@ -4171,7 +4188,7 @@ async function buildImage(imageRef, appName, buildArgs) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$4.log(`✅ Image built: ${imageRef}`);
+		logger$6.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
 		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -4180,13 +4197,13 @@ async function buildImage(imageRef, appName, buildArgs) {
 * Push Docker image to registry
 */
 async function pushImage(imageRef) {
-	logger$4.log(`\n☁️  Pushing image: ${imageRef}`);
+	logger$6.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
 		execSync(`docker push ${imageRef}`, {
 			cwd: process.cwd(),
 			stdio: "inherit"
 		});
-		logger$4.log(`✅ Image pushed: ${imageRef}`);
+		logger$6.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
 		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
@@ -4199,17 +4216,17 @@ async function deployDocker(options) {
 	const imageName = config$1.imageName;
 	const imageRef = getImageRef(config$1.registry, imageName, tag);
 	await buildImage(imageRef, config$1.appName, buildArgs);
-	if (!skipPush) if (!config$1.registry) logger$4.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+	if (!skipPush) if (!config$1.registry) logger$6.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 	else await pushImage(imageRef);
-	logger$4.log("\n✅ Docker deployment ready!");
-	logger$4.log(`\n📋 Deployment details:`);
-	logger$4.log(`   Image: ${imageRef}`);
-	logger$4.log(`   Stage: ${stage}`);
+	logger$6.log("\n✅ Docker deployment ready!");
+	logger$6.log(`\n📋 Deployment details:`);
+	logger$6.log(`   Image: ${imageRef}`);
+	logger$6.log(`   Stage: ${stage}`);
 	if (masterKey) {
-		logger$4.log(`\n🔐 Deploy with this environment variable:`);
-		logger$4.log(`   GKM_MASTER_KEY=${masterKey}`);
-		logger$4.log("\n   Example docker run:");
-		logger$4.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
+		logger$6.log(`\n🔐 Deploy with this environment variable:`);
+		logger$6.log(`   GKM_MASTER_KEY=${masterKey}`);
+		logger$6.log("\n   Example docker run:");
+		logger$6.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
 	}
 	return {
 		imageRef,
@@ -4236,7 +4253,7 @@ function resolveDockerConfig(config$1) {
 
 //#endregion
 //#region src/deploy/dokploy.ts
-const logger$3 = console;
+const logger$5 = console;
 /**
 * Get the Dokploy API token from stored credentials or environment
 */
@@ -4260,25 +4277,25 @@ async function createApi$1(endpoint) {
 */
 async function deployDokploy(options) {
 	const { stage, imageRef, masterKey, config: config$1 } = options;
-	logger$3.log(`\n🎯 Deploying to Dokploy...`);
-	logger$3.log(`   Endpoint: ${config$1.endpoint}`);
-	logger$3.log(`   Application: ${config$1.applicationId}`);
+	logger$5.log(`\n🎯 Deploying to Dokploy...`);
+	logger$5.log(`   Endpoint: ${config$1.endpoint}`);
+	logger$5.log(`   Application: ${config$1.applicationId}`);
 	const api = await createApi$1(config$1.endpoint);
-	logger$3.log(`  Configuring Docker image: ${imageRef}`);
+	logger$5.log(`  Configuring Docker image: ${imageRef}`);
 	const registryOptions = {};
 	if (config$1.registryId) {
 		registryOptions.registryId = config$1.registryId;
-		logger$3.log(`  Using Dokploy registry: ${config$1.registryId}`);
+		logger$5.log(`  Using Dokploy registry: ${config$1.registryId}`);
 	} else {
 		const storedRegistryId = await getDokployRegistryId();
 		if (storedRegistryId) {
 			registryOptions.registryId = storedRegistryId;
-			logger$3.log(`  Using stored Dokploy registry: ${storedRegistryId}`);
+			logger$5.log(`  Using stored Dokploy registry: ${storedRegistryId}`);
 		} else if (config$1.registryCredentials) {
 			registryOptions.username = config$1.registryCredentials.username;
 			registryOptions.password = config$1.registryCredentials.password;
 			registryOptions.registryUrl = config$1.registryCredentials.registryUrl;
-			logger$3.log(`  Using registry credentials for: ${config$1.registryCredentials.registryUrl}`);
+			logger$5.log(`  Using registry credentials for: ${config$1.registryCredentials.registryUrl}`);
 		} else {
 			const username = process.env.DOCKER_REGISTRY_USERNAME;
 			const password = process.env.DOCKER_REGISTRY_PASSWORD;
@@ -4287,31 +4304,31 @@ async function deployDokploy(options) {
 				registryOptions.username = username;
 				registryOptions.password = password;
 				registryOptions.registryUrl = registryUrl;
-				logger$3.log(`  Using registry credentials from environment`);
+				logger$5.log(`  Using registry credentials from environment`);
 			}
 		}
 	}
 	await api.saveDockerProvider(config$1.applicationId, imageRef, registryOptions);
-	logger$3.log("  ✓ Docker provider configured");
+	logger$5.log("  ✓ Docker provider configured");
 	const envVars = {};
 	if (masterKey) envVars.GKM_MASTER_KEY = masterKey;
 	if (Object.keys(envVars).length > 0) {
-		logger$3.log("  Updating environment variables...");
+		logger$5.log("  Updating environment variables...");
 		const envString = Object.entries(envVars).map(([key, value]) => `${key}=${value}`).join("\n");
 		await api.saveApplicationEnv(config$1.applicationId, envString);
-		logger$3.log("  ✓ Environment variables updated");
+		logger$5.log("  ✓ Environment variables updated");
 	}
-	logger$3.log("  Triggering deployment...");
+	logger$5.log("  Triggering deployment...");
 	await api.deployApplication(config$1.applicationId);
-	logger$3.log("  ✓ Deployment triggered");
-	logger$3.log("\n✅ Dokploy deployment initiated!");
-	logger$3.log(`\n📋 Deployment details:`);
-	logger$3.log(`   Image: ${imageRef}`);
-	logger$3.log(`   Stage: ${stage}`);
-	logger$3.log(`   Application ID: ${config$1.applicationId}`);
-	if (masterKey) logger$3.log(`\n🔐 GKM_MASTER_KEY has been set in Dokploy environment`);
+	logger$5.log("  ✓ Deployment triggered");
+	logger$5.log("\n✅ Dokploy deployment initiated!");
+	logger$5.log(`\n📋 Deployment details:`);
+	logger$5.log(`   Image: ${imageRef}`);
+	logger$5.log(`   Stage: ${stage}`);
+	logger$5.log(`   Application ID: ${config$1.applicationId}`);
+	if (masterKey) logger$5.log(`\n🔐 GKM_MASTER_KEY has been set in Dokploy environment`);
 	const deploymentUrl = `${config$1.endpoint}/project/${config$1.projectId}`;
-	logger$3.log(`\n🔗 View deployment: ${deploymentUrl}`);
+	logger$5.log(`\n🔗 View deployment: ${deploymentUrl}`);
 	return {
 		imageRef,
 		masterKey,
@@ -4477,7 +4494,7 @@ function validateEnvVars(requiredVars, context) {
 
 //#endregion
 //#region src/deploy/init.ts
-const logger$2 = console;
+const logger$4 = console;
 /**
 * Get the Dokploy API token from stored credentials or environment
 */
@@ -4511,20 +4528,20 @@ async function createApi(endpoint) {
 async function updateConfig(config$1, cwd = process.cwd()) {
 	const configPath = join(cwd, "gkm.config.ts");
 	if (!existsSync(configPath)) {
-		logger$2.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
-		logger$2.log(`  providers: {`);
-		logger$2.log(`    dokploy: {`);
-		logger$2.log(`      endpoint: '${config$1.endpoint}',`);
-		logger$2.log(`      projectId: '${config$1.projectId}',`);
-		logger$2.log(`      applicationId: '${config$1.applicationId}',`);
-		logger$2.log(`    },`);
-		logger$2.log(`  },`);
+		logger$4.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
+		logger$4.log(`  providers: {`);
+		logger$4.log(`    dokploy: {`);
+		logger$4.log(`      endpoint: '${config$1.endpoint}',`);
+		logger$4.log(`      projectId: '${config$1.projectId}',`);
+		logger$4.log(`      applicationId: '${config$1.applicationId}',`);
+		logger$4.log(`    },`);
+		logger$4.log(`  },`);
 		return;
 	}
 	const content = await readFile(configPath, "utf-8");
 	if (content.includes("dokploy:") && content.includes("applicationId:")) {
-		logger$2.log("\n  Dokploy config already exists in gkm.config.ts");
-		logger$2.log("  Updating with new values...");
+		logger$4.log("\n  Dokploy config already exists in gkm.config.ts");
+		logger$4.log("  Updating with new values...");
 	}
 	const registryLine = config$1.registryId ? `\n\t\t\tregistryId: '${config$1.registryId}',` : "";
 	const dokployConfigStr = `dokploy: {
@@ -4541,7 +4558,7 @@ async function updateConfig(config$1, cwd = process.cwd()) {
 	},
 });`);
 	await writeFile(configPath, newContent);
-	logger$2.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
+	logger$4.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
 }
 /**
 * Initialize Dokploy deployment configuration
@@ -4550,24 +4567,24 @@ async function deployInitCommand(options) {
 	const { projectName, appName, projectId: existingProjectId, registryId } = options;
 	const endpoint = await getEndpoint(options.endpoint);
 	const api = await createApi(endpoint);
-	logger$2.log(`\n🚀 Initializing Dokploy deployment...`);
-	logger$2.log(`   Endpoint: ${endpoint}`);
+	logger$4.log(`\n🚀 Initializing Dokploy deployment...`);
+	logger$4.log(`   Endpoint: ${endpoint}`);
 	let projectId;
 	if (existingProjectId) {
 		projectId = existingProjectId;
-		logger$2.log(`\n📁 Using existing project: ${projectId}`);
+		logger$4.log(`\n📁 Using existing project: ${projectId}`);
 	} else {
-		logger$2.log(`\n📁 Looking for project: ${projectName}`);
+		logger$4.log(`\n📁 Looking for project: ${projectName}`);
 		const projects = await api.listProjects();
 		const existingProject = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 		if (existingProject) {
 			projectId = existingProject.projectId;
-			logger$2.log(`   Found existing project: ${projectId}`);
+			logger$4.log(`   Found existing project: ${projectId}`);
 		} else {
-			logger$2.log(`   Creating new project...`);
+			logger$4.log(`   Creating new project...`);
 			const result = await api.createProject(projectName);
 			projectId = result.project.projectId;
-			logger$2.log(`   ✓ Created project: ${projectId}`);
+			logger$4.log(`   ✓ Created project: ${projectId}`);
 		}
 	}
 	const project = await api.getProject(projectId);
@@ -4575,23 +4592,23 @@ async function deployInitCommand(options) {
 	const firstEnv = project.environments?.[0];
 	if (firstEnv) environmentId = firstEnv.environmentId;
 	else {
-		logger$2.log(`   Creating production environment...`);
+		logger$4.log(`   Creating production environment...`);
 		const env = await api.createEnvironment(projectId, "production");
 		environmentId = env.environmentId;
 	}
-	logger$2.log(`\n📦 Creating application: ${appName}`);
+	logger$4.log(`\n📦 Creating application: ${appName}`);
 	const application = await api.createApplication(appName, projectId, environmentId);
-	logger$2.log(`   ✓ Created application: ${application.applicationId}`);
+	logger$4.log(`   ✓ Created application: ${application.applicationId}`);
 	if (registryId) {
-		logger$2.log(`\n🔧 Configuring registry: ${registryId}`);
+		logger$4.log(`\n🔧 Configuring registry: ${registryId}`);
 		await api.updateApplication(application.applicationId, { registryId });
-		logger$2.log(`   ✓ Registry configured`);
+		logger$4.log(`   ✓ Registry configured`);
 	} else try {
 		const registries = await api.listRegistries();
 		if (registries.length > 0) {
-			logger$2.log(`\n📋 Available registries:`);
-			for (const reg of registries) logger$2.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
-			logger$2.log(`\n   To use a registry, run with --registry-id <id>`);
+			logger$4.log(`\n📋 Available registries:`);
+			for (const reg of registries) logger$4.log(`   - ${reg.registryName}: ${reg.registryUrl} (${reg.registryId})`);
+			logger$4.log(`\n   To use a registry, run with --registry-id <id>`);
 		}
 	} catch {}
 	const config$1 = {
@@ -4600,14 +4617,14 @@ async function deployInitCommand(options) {
 		applicationId: application.applicationId
 	};
 	await updateConfig(config$1);
-	logger$2.log(`\n✅ Dokploy deployment initialized!`);
-	logger$2.log(`\n📋 Configuration:`);
-	logger$2.log(`   Project ID: ${projectId}`);
-	logger$2.log(`   Application ID: ${application.applicationId}`);
-	logger$2.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
-	logger$2.log(`\n📝 Next steps:`);
-	logger$2.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
-	logger$2.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
+	logger$4.log(`\n✅ Dokploy deployment initialized!`);
+	logger$4.log(`\n📋 Configuration:`);
+	logger$4.log(`   Project ID: ${projectId}`);
+	logger$4.log(`   Application ID: ${application.applicationId}`);
+	logger$4.log(`\n🔗 View in Dokploy: ${endpoint}/project/${projectId}`);
+	logger$4.log(`\n📝 Next steps:`);
+	logger$4.log(`   1. Initialize secrets: gkm secrets:init --stage production`);
+	logger$4.log(`   2. Deploy: gkm deploy --provider dokploy --stage production`);
 	return config$1;
 }
 /**
@@ -4618,32 +4635,32 @@ async function deployListCommand(options) {
 	const api = await createApi(endpoint);
 	const { resource } = options;
 	if (resource === "projects") {
-		logger$2.log(`\n📁 Projects in ${endpoint}:`);
+		logger$4.log(`\n📁 Projects in ${endpoint}:`);
 		const projects = await api.listProjects();
 		if (projects.length === 0) {
-			logger$2.log("   No projects found");
+			logger$4.log("   No projects found");
 			return;
 		}
 		for (const project of projects) {
-			logger$2.log(`\n   ${project.name} (${project.projectId})`);
-			if (project.description) logger$2.log(`     ${project.description}`);
+			logger$4.log(`\n   ${project.name} (${project.projectId})`);
+			if (project.description) logger$4.log(`     ${project.description}`);
 		}
 	} else if (resource === "registries") {
-		logger$2.log(`\n🐳 Registries in ${endpoint}:`);
+		logger$4.log(`\n🐳 Registries in ${endpoint}:`);
 		const registries = await api.listRegistries();
 		if (registries.length === 0) {
-			logger$2.log("   No registries configured");
-			logger$2.log("   Run \"gkm registry:setup\" to configure a registry");
+			logger$4.log("   No registries configured");
+			logger$4.log("   Run \"gkm registry:setup\" to configure a registry");
 			return;
 		}
 		const storedRegistryId = await getDokployRegistryId();
 		for (const registry of registries) {
 			const isDefault = registry.registryId === storedRegistryId;
 			const marker = isDefault ? " (default)" : "";
-			logger$2.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
-			logger$2.log(`     URL: ${registry.registryUrl}`);
-			logger$2.log(`     Username: ${registry.username}`);
-			if (registry.imagePrefix) logger$2.log(`     Prefix: ${registry.imagePrefix}`);
+			logger$4.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
+			logger$4.log(`     URL: ${registry.registryUrl}`);
+			logger$4.log(`     Username: ${registry.username}`);
+			if (registry.imagePrefix) logger$4.log(`     Prefix: ${registry.imagePrefix}`);
 		}
 	}
 }
@@ -4666,19 +4683,19 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config: config$1, workspaceRoot, workspaceName } = options;
 	if (!config$1) {
-		const { LocalStateProvider } = await import("./LocalStateProvider-BDm7ZqJo.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await import("./LocalStateProvider-BDm7ZqJo.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await import("./LocalStateProvider-BDm7ZqJo.mjs");
-		const { SSMStateProvider } = await import("./SSMStateProvider-DT0WV-E_.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Dp0KkRcw.mjs");
+		const { SSMStateProvider } = await import("./SSMStateProvider-CksOTB8M.mjs");
 		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-CI61keQ1.mjs");
 		const ssmConfig = config$1;
 		const local = new LocalStateProvider(workspaceRoot);
@@ -5111,7 +5128,7 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 
 //#endregion
 //#region src/deploy/index.ts
-const logger$1 = console;
+const logger$3 = console;
 /**
 * Prompt for input
 */
@@ -5183,7 +5200,7 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 		return;
 	} catch {
 		if (i < maxRetries - 1) {
-			logger$1.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			logger$3.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
 			await new Promise((r) => setTimeout(r, retryIntervalMs));
 		}
 	}
@@ -5218,12 +5235,12 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 * ```
 */
 async function initializePostgresUsers(api, postgres, serverHostname, users) {
-	logger$1.log("\n🔧 Initializing database users...");
+	logger$3.log("\n🔧 Initializing database users...");
 	const externalPort = 5432;
-	logger$1.log(`   Enabling external port ${externalPort}...`);
+	logger$3.log(`   Enabling external port ${externalPort}...`);
 	await api.savePostgresExternalPort(postgres.postgresId, externalPort);
 	await api.deployPostgres(postgres.postgresId);
-	logger$1.log(`   Waiting for Postgres to be accessible at ${serverHostname}:${externalPort}...`);
+	logger$3.log(`   Waiting for Postgres to be accessible at ${serverHostname}:${externalPort}...`);
 	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
 	const client = new Client({
 		host: serverHostname,
@@ -5236,7 +5253,7 @@ async function initializePostgresUsers(api, postgres, serverHostname, users) {
 		await client.connect();
 		for (const user of users) {
 			const schemaName = user.usePublicSchema ? "public" : user.name;
-			logger$1.log(`   Creating user "${user.name}" with schema "${schemaName}"...`);
+			logger$3.log(`   Creating user "${user.name}" with schema "${schemaName}"...`);
 			if (user.usePublicSchema) {
 				await client.query(`
 					DO $$ BEGIN
@@ -5271,15 +5288,15 @@ async function initializePostgresUsers(api, postgres, serverHostname, users) {
 					ALTER DEFAULT PRIVILEGES IN SCHEMA "${schemaName}" GRANT ALL ON TABLES TO "${user.name}";
 				`);
 			}
-			logger$1.log(`   ✓ User "${user.name}" configured`);
+			logger$3.log(`   ✓ User "${user.name}" configured`);
 		}
 	} finally {
 		await client.end();
 	}
-	logger$1.log("   Disabling external port...");
+	logger$3.log("   Disabling external port...");
 	await api.savePostgresExternalPort(postgres.postgresId, null);
 	await api.deployPostgres(postgres.postgresId);
-	logger$1.log("   ✓ Database users initialized");
+	logger$3.log("   ✓ Database users initialized");
 }
 /**
 * Get the server hostname from the Dokploy endpoint URL
@@ -5293,24 +5310,24 @@ function getServerHostname(endpoint) {
 * @internal Exported for testing
 */
 async function provisionServices(api, projectId, environmentId, projectName, services, existingServiceIds) {
-	logger$1.log(`\n🔍 provisionServices called: services=${JSON.stringify(services)}, envId=${environmentId}`);
+	logger$3.log(`\n🔍 provisionServices called: services=${JSON.stringify(services)}, envId=${environmentId}`);
 	if (!services || !environmentId) {
-		logger$1.log("   Skipping: no services or no environmentId");
+		logger$3.log("   Skipping: no services or no environmentId");
 		return void 0;
 	}
 	const serviceUrls = {};
 	const serviceIds = {};
 	if (services.postgres) {
-		logger$1.log("\n🐘 Checking PostgreSQL...");
+		logger$3.log("\n🐘 Checking PostgreSQL...");
 		const postgresName = "db";
 		try {
 			let postgres = null;
 			let created = false;
 			if (existingServiceIds?.postgresId) {
-				logger$1.log(`   Using cached ID: ${existingServiceIds.postgresId}`);
+				logger$3.log(`   Using cached ID: ${existingServiceIds.postgresId}`);
 				postgres = await api.getPostgres(existingServiceIds.postgresId);
-				if (postgres) logger$1.log(`   ✓ PostgreSQL found: ${postgres.postgresId}`);
-				else logger$1.log(`   ⚠ Cached ID invalid, will create new`);
+				if (postgres) logger$3.log(`   ✓ PostgreSQL found: ${postgres.postgresId}`);
+				else logger$3.log(`   ⚠ Cached ID invalid, will create new`);
 			}
 			if (!postgres) {
 				const databasePassword = randomBytes(16).toString("hex");
@@ -5322,10 +5339,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 				postgres = result.postgres;
 				created = result.created;
 				if (created) {
-					logger$1.log(`   ✓ Created PostgreSQL: ${postgres.postgresId}`);
+					logger$3.log(`   ✓ Created PostgreSQL: ${postgres.postgresId}`);
 					await api.deployPostgres(postgres.postgresId);
-					logger$1.log("   ✓ PostgreSQL deployed");
-				} else logger$1.log(`   ✓ PostgreSQL already exists: ${postgres.postgresId}`);
+					logger$3.log("   ✓ PostgreSQL deployed");
+				} else logger$3.log(`   ✓ PostgreSQL already exists: ${postgres.postgresId}`);
 			}
 			serviceIds.postgresId = postgres.postgresId;
 			serviceUrls.DATABASE_HOST = postgres.appName;
@@ -5334,23 +5351,23 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 			serviceUrls.DATABASE_USER = postgres.databaseUser;
 			serviceUrls.DATABASE_PASSWORD = postgres.databasePassword;
 			serviceUrls.DATABASE_URL = `postgresql://${postgres.databaseUser}:${postgres.databasePassword}@${postgres.appName}:5432/${postgres.databaseName}`;
-			logger$1.log(`   ✓ Database credentials configured`);
+			logger$3.log(`   ✓ Database credentials configured`);
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$1.log(`   ⚠ Failed to provision PostgreSQL: ${message}`);
+			logger$3.log(`   ⚠ Failed to provision PostgreSQL: ${message}`);
 		}
 	}
 	if (services.redis) {
-		logger$1.log("\n🔴 Checking Redis...");
+		logger$3.log("\n🔴 Checking Redis...");
 		const redisName = "cache";
 		try {
 			let redis = null;
 			let created = false;
 			if (existingServiceIds?.redisId) {
-				logger$1.log(`   Using cached ID: ${existingServiceIds.redisId}`);
+				logger$3.log(`   Using cached ID: ${existingServiceIds.redisId}`);
 				redis = await api.getRedis(existingServiceIds.redisId);
-				if (redis) logger$1.log(`   ✓ Redis found: ${redis.redisId}`);
-				else logger$1.log(`   ⚠ Cached ID invalid, will create new`);
+				if (redis) logger$3.log(`   ✓ Redis found: ${redis.redisId}`);
+				else logger$3.log(`   ⚠ Cached ID invalid, will create new`);
 			}
 			if (!redis) {
 				const { randomBytes: randomBytes$1 } = await import("node:crypto");
@@ -5359,10 +5376,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 				redis = result.redis;
 				created = result.created;
 				if (created) {
-					logger$1.log(`   ✓ Created Redis: ${redis.redisId}`);
+					logger$3.log(`   ✓ Created Redis: ${redis.redisId}`);
 					await api.deployRedis(redis.redisId);
-					logger$1.log("   ✓ Redis deployed");
-				} else logger$1.log(`   ✓ Redis already exists: ${redis.redisId}`);
+					logger$3.log("   ✓ Redis deployed");
+				} else logger$3.log(`   ✓ Redis already exists: ${redis.redisId}`);
 			}
 			serviceIds.redisId = redis.redisId;
 			serviceUrls.REDIS_HOST = redis.appName;
@@ -5370,10 +5387,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 			if (redis.databasePassword) serviceUrls.REDIS_PASSWORD = redis.databasePassword;
 			const password = redis.databasePassword ? `:${redis.databasePassword}@` : "";
 			serviceUrls.REDIS_URL = `redis://${password}${redis.appName}:6379`;
-			logger$1.log(`   ✓ Redis credentials configured`);
+			logger$3.log(`   ✓ Redis credentials configured`);
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$1.log(`   ⚠ Failed to provision Redis: ${message}`);
+			logger$3.log(`   ⚠ Failed to provision Redis: ${message}`);
 		}
 	}
 	return Object.keys(serviceUrls).length > 0 ? {
@@ -5385,10 +5402,10 @@ async function provisionServices(api, projectId, environmentId, projectName, ser
 * Ensure Dokploy is fully configured, recovering/creating resources as needed
 */
 async function ensureDokploySetup(config$1, dockerConfig, stage, services) {
-	logger$1.log("\n🔧 Checking Dokploy setup...");
+	logger$3.log("\n🔧 Checking Dokploy setup...");
 	let creds = await getDokployCredentials();
 	if (!creds) {
-		logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
+		logger$3.log("\n📋 Dokploy credentials not found. Let's set them up.");
 		const endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ");
 		const normalizedEndpoint = endpoint.replace(/\/$/, "");
 		try {
@@ -5396,9 +5413,9 @@ async function ensureDokploySetup(config$1, dockerConfig, stage, services) {
 		} catch {
 			throw new Error("Invalid URL format");
 		}
-		logger$1.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
+		logger$3.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
 		const token = await prompt("API Token: ", true);
-		logger$1.log("\nValidating credentials...");
+		logger$3.log("\nValidating credentials...");
 		const isValid = await validateDokployToken(normalizedEndpoint, token);
 		if (!isValid) throw new Error("Invalid credentials. Please check your token.");
 		await storeDokployCredentials(token, normalizedEndpoint);
@@ -5406,7 +5423,7 @@ async function ensureDokploySetup(config$1, dockerConfig, stage, services) {
 			token,
 			endpoint: normalizedEndpoint
 		};
-		logger$1.log("✓ Credentials saved");
+		logger$3.log("✓ Credentials saved");
 	}
 	const api = new DokployApi({
 		baseUrl: creds.endpoint,
@@ -5414,20 +5431,20 @@ async function ensureDokploySetup(config$1, dockerConfig, stage, services) {
 	});
 	const existingConfig = config$1.providers?.dokploy;
 	if (existingConfig && typeof existingConfig !== "boolean" && existingConfig.applicationId && existingConfig.projectId) {
-		logger$1.log("✓ Dokploy config found in gkm.config.ts");
+		logger$3.log("✓ Dokploy config found in gkm.config.ts");
 		try {
 			const projectDetails = await api.getProject(existingConfig.projectId);
-			logger$1.log("✓ Project verified");
+			logger$3.log("✓ Project verified");
 			const storedRegistryId = existingConfig.registryId ?? await getDokployRegistryId();
 			const environments = projectDetails.environments ?? [];
 			let environment = environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 			if (!environment) {
-				logger$1.log(`   Creating "${stage}" environment...`);
+				logger$3.log(`   Creating "${stage}" environment...`);
 				environment = await api.createEnvironment(existingConfig.projectId, stage);
-				logger$1.log(`   ✓ Created environment: ${environment.environmentId}`);
+				logger$3.log(`   ✓ Created environment: ${environment.environmentId}`);
 			}
 			const environmentId$1 = environment.environmentId;
-			logger$1.log(`   Services config: ${JSON.stringify(services)}, envId: ${environmentId$1}`);
+			logger$3.log(`   Services config: ${JSON.stringify(services)}, envId: ${environmentId$1}`);
 			const provisionResult$1 = await provisionServices(api, existingConfig.projectId, environmentId$1, dockerConfig.appName, services, void 0);
 			return {
 				config: {
@@ -5440,97 +5457,97 @@ async function ensureDokploySetup(config$1, dockerConfig, stage, services) {
 				serviceUrls: provisionResult$1?.serviceUrls
 			};
 		} catch {
-			logger$1.log("⚠ Project not found, will recover...");
+			logger$3.log("⚠ Project not found, will recover...");
 		}
 	}
-	logger$1.log("\n📁 Looking for project...");
+	logger$3.log("\n📁 Looking for project...");
 	const projectName = dockerConfig.projectName;
 	const projects = await api.listProjects();
 	let project = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 	let environmentId;
 	if (project) {
-		logger$1.log(`   Found existing project: ${project.name} (${project.projectId})`);
+		logger$3.log(`   Found existing project: ${project.name} (${project.projectId})`);
 		const projectDetails = await api.getProject(project.projectId);
 		const environments = projectDetails.environments ?? [];
 		const matchingEnv = environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 		if (matchingEnv) {
 			environmentId = matchingEnv.environmentId;
-			logger$1.log(`   Using environment: ${matchingEnv.name}`);
+			logger$3.log(`   Using environment: ${matchingEnv.name}`);
 		} else {
-			logger$1.log(`   Creating "${stage}" environment...`);
+			logger$3.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
-			logger$1.log(`   ✓ Created environment: ${stage}`);
+			logger$3.log(`   ✓ Created environment: ${stage}`);
 		}
 	} else {
-		logger$1.log(`   Creating project: ${projectName}`);
+		logger$3.log(`   Creating project: ${projectName}`);
 		const result = await api.createProject(projectName);
 		project = result.project;
 		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
-			logger$1.log(`   Creating "${stage}" environment...`);
+			logger$3.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
 		} else environmentId = result.environment.environmentId;
-		logger$1.log(`   ✓ Created project: ${project.projectId}`);
-		logger$1.log(`   ✓ Using environment: ${stage}`);
+		logger$3.log(`   ✓ Created project: ${project.projectId}`);
+		logger$3.log(`   ✓ Using environment: ${stage}`);
 	}
-	logger$1.log("\n📦 Looking for application...");
+	logger$3.log("\n📦 Looking for application...");
 	const appName = dockerConfig.appName;
 	let applicationId;
 	if (existingConfig && typeof existingConfig !== "boolean" && existingConfig.applicationId) {
 		applicationId = existingConfig.applicationId;
-		logger$1.log(`   Using application from config: ${applicationId}`);
+		logger$3.log(`   Using application from config: ${applicationId}`);
 	} else {
-		logger$1.log(`   Creating application: ${appName}`);
+		logger$3.log(`   Creating application: ${appName}`);
 		const app = await api.createApplication(appName, project.projectId, environmentId);
 		applicationId = app.applicationId;
-		logger$1.log(`   ✓ Created application: ${applicationId}`);
+		logger$3.log(`   ✓ Created application: ${applicationId}`);
 	}
-	logger$1.log("\n🐳 Checking registry...");
+	logger$3.log("\n🐳 Checking registry...");
 	let registryId = await getDokployRegistryId();
 	if (registryId) try {
 		const registry = await api.getRegistry(registryId);
-		logger$1.log(`   Using registry: ${registry.registryName}`);
+		logger$3.log(`   Using registry: ${registry.registryName}`);
 	} catch {
-		logger$1.log("   ⚠ Stored registry not found, clearing...");
+		logger$3.log("   ⚠ Stored registry not found, clearing...");
 		registryId = void 0;
 		await storeDokployRegistryId("");
 	}
 	if (!registryId) {
 		const registries = await api.listRegistries();
 		if (registries.length === 0) if (dockerConfig.registry) {
-			logger$1.log("   No registries found in Dokploy. Let's create one.");
-			logger$1.log(`   Registry URL: ${dockerConfig.registry}`);
+			logger$3.log("   No registries found in Dokploy. Let's create one.");
+			logger$3.log(`   Registry URL: ${dockerConfig.registry}`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
 			const registry = await api.createRegistry("Default Registry", dockerConfig.registry, username, password);
 			registryId = registry.registryId;
 			await storeDokployRegistryId(registryId);
-			logger$1.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$1.log("   ⚠ No registry configured. Set docker.registry in gkm.config.ts");
+			logger$3.log(`   ✓ Registry created: ${registryId}`);
+		} else logger$3.log("   ⚠ No registry configured. Set docker.registry in gkm.config.ts");
 		else {
-			logger$1.log("   Available registries:");
+			logger$3.log("   Available registries:");
 			registries.forEach((reg, i) => {
-				logger$1.log(`     ${i + 1}. ${reg.registryName} (${reg.registryUrl})`);
+				logger$3.log(`     ${i + 1}. ${reg.registryName} (${reg.registryUrl})`);
 			});
-			if (dockerConfig.registry) logger$1.log(`     ${registries.length + 1}. Create new registry`);
+			if (dockerConfig.registry) logger$3.log(`     ${registries.length + 1}. Create new registry`);
 			const maxOption = dockerConfig.registry ? registries.length + 1 : registries.length;
 			const selection = await prompt(`   Select registry (1-${maxOption}): `);
 			const index = parseInt(selection, 10) - 1;
 			if (index >= 0 && index < registries.length) {
 				registryId = registries[index].registryId;
 				await storeDokployRegistryId(registryId);
-				logger$1.log(`   ✓ Selected: ${registries[index].registryName}`);
+				logger$3.log(`   ✓ Selected: ${registries[index].registryName}`);
 			} else if (dockerConfig.registry && index === registries.length) {
-				logger$1.log(`\n   Creating new registry...`);
-				logger$1.log(`   Registry URL: ${dockerConfig.registry}`);
+				logger$3.log(`\n   Creating new registry...`);
+				logger$3.log(`   Registry URL: ${dockerConfig.registry}`);
 				const username = await prompt("   Registry username: ");
 				const password = await prompt("   Registry password/token: ", true);
 				const registry = await api.createRegistry(dockerConfig.registry.replace(/^https?:\/\//, ""), dockerConfig.registry, username, password);
 				registryId = registry.registryId;
 				await storeDokployRegistryId(registryId);
-				logger$1.log(`   ✓ Registry created: ${registryId}`);
-			} else logger$1.log("   ⚠ Invalid selection, skipping registry setup");
+				logger$3.log(`   ✓ Registry created: ${registryId}`);
+			} else logger$3.log("   ⚠ Invalid selection, skipping registry setup");
 		}
 	}
 	const dokployConfig = {
@@ -5540,10 +5557,10 @@ async function ensureDokploySetup(config$1, dockerConfig, stage, services) {
 		registryId: registryId ?? void 0
 	};
 	await updateConfig(dokployConfig);
-	logger$1.log("\n✅ Dokploy setup complete!");
-	logger$1.log(`   Project: ${project.projectId}`);
-	logger$1.log(`   Application: ${applicationId}`);
-	if (registryId) logger$1.log(`   Registry: ${registryId}`);
+	logger$3.log("\n✅ Dokploy setup complete!");
+	logger$3.log(`   Project: ${project.projectId}`);
+	logger$3.log(`   Application: ${applicationId}`);
+	if (registryId) logger$3.log(`   Registry: ${registryId}`);
 	const provisionResult = await provisionServices(api, project.projectId, environmentId, dockerConfig.appName, services, void 0);
 	return {
 		config: dokployConfig,
@@ -5574,45 +5591,45 @@ function generateTag(stage) {
 async function workspaceDeployCommand(workspace, options) {
 	const { provider, stage, tag, apps: selectedApps } = options;
 	if (provider !== "dokploy") throw new Error(`Workspace deployment only supports Dokploy. Got: ${provider}`);
-	logger$1.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
-	logger$1.log(`   Stage: ${stage}`);
+	logger$3.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
+	logger$3.log(`   Stage: ${stage}`);
 	const imageTag = tag ?? generateTag(stage);
-	logger$1.log(`   Tag: ${imageTag}`);
+	logger$3.log(`   Tag: ${imageTag}`);
 	const buildOrder = getAppBuildOrder(workspace);
 	let appsToDeployNames = buildOrder;
 	if (selectedApps && selectedApps.length > 0) {
 		const invalidApps = selectedApps.filter((name$1) => !workspace.apps[name$1]);
 		if (invalidApps.length > 0) throw new Error(`Unknown apps: ${invalidApps.join(", ")}\nAvailable apps: ${Object.keys(workspace.apps).join(", ")}`);
 		appsToDeployNames = buildOrder.filter((name$1) => selectedApps.includes(name$1));
-		logger$1.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
-	} else logger$1.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
+		logger$3.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
+	} else logger$3.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
 	const dokployApps = appsToDeployNames.filter((name$1) => {
 		const app = workspace.apps[name$1];
 		const target = app.resolvedDeployTarget;
 		if (!isDeployTargetSupported(target)) {
-			logger$1.log(`   ⚠️  Skipping ${name$1}: ${getDeployTargetError(target, name$1)}`);
+			logger$3.log(`   ⚠️  Skipping ${name$1}: ${getDeployTargetError(target, name$1)}`);
 			return false;
 		}
 		return true;
 	});
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
-	logger$1.log("\n🔐 Loading secrets and analyzing environment requirements...");
+	logger$3.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const stageSecrets = await readStageSecrets(stage, workspace.root);
 	if (!stageSecrets) {
-		logger$1.log(`   ⚠️  No secrets found for stage "${stage}"`);
-		logger$1.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
+		logger$3.log(`   ⚠️  No secrets found for stage "${stage}"`);
+		logger$3.log(`      Run "gkm secrets:init --stage ${stage}" to create secrets`);
 	}
 	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
 	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
 	if (stageSecrets) {
 		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
-		if (report.appsWithSecrets.length > 0) logger$1.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
-		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger$1.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
+		if (report.appsWithSecrets.length > 0) logger$3.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
+		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger$3.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
 	}
 	let creds = await getDokployCredentials();
 	if (!creds) {
-		logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
+		logger$3.log("\n📋 Dokploy credentials not found. Let's set them up.");
 		const endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ");
 		const normalizedEndpoint = endpoint.replace(/\/$/, "");
 		try {
@@ -5620,9 +5637,9 @@ async function workspaceDeployCommand(workspace, options) {
 		} catch {
 			throw new Error("Invalid URL format");
 		}
-		logger$1.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
+		logger$3.log(`\nGenerate a token at: ${normalizedEndpoint}/settings/profile\n`);
 		const token = await prompt("API Token: ", true);
-		logger$1.log("\nValidating credentials...");
+		logger$3.log("\nValidating credentials...");
 		const isValid = await validateDokployToken(normalizedEndpoint, token);
 		if (!isValid) throw new Error("Invalid credentials. Please check your token.");
 		await storeDokployCredentials(token, normalizedEndpoint);
@@ -5630,43 +5647,43 @@ async function workspaceDeployCommand(workspace, options) {
 			token,
 			endpoint: normalizedEndpoint
 		};
-		logger$1.log("✓ Credentials saved");
+		logger$3.log("✓ Credentials saved");
 	}
 	const api = new DokployApi({
 		baseUrl: creds.endpoint,
 		token: creds.token
 	});
-	logger$1.log("\n📁 Setting up Dokploy project...");
+	logger$3.log("\n📁 Setting up Dokploy project...");
 	const projectName = workspace.name;
 	const projects = await api.listProjects();
 	let project = projects.find((p) => p.name.toLowerCase() === projectName.toLowerCase());
 	let environmentId;
 	if (project) {
-		logger$1.log(`   Found existing project: ${project.name}`);
+		logger$3.log(`   Found existing project: ${project.name}`);
 		const projectDetails = await api.getProject(project.projectId);
 		const environments = projectDetails.environments ?? [];
 		const matchingEnv = environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 		if (matchingEnv) {
 			environmentId = matchingEnv.environmentId;
-			logger$1.log(`   Using environment: ${matchingEnv.name}`);
+			logger$3.log(`   Using environment: ${matchingEnv.name}`);
 		} else {
-			logger$1.log(`   Creating "${stage}" environment...`);
+			logger$3.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
-			logger$1.log(`   ✓ Created environment: ${stage}`);
+			logger$3.log(`   ✓ Created environment: ${stage}`);
 		}
 	} else {
-		logger$1.log(`   Creating project: ${projectName}`);
+		logger$3.log(`   Creating project: ${projectName}`);
 		const result = await api.createProject(projectName);
 		project = result.project;
 		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
-			logger$1.log(`   Creating "${stage}" environment...`);
+			logger$3.log(`   Creating "${stage}" environment...`);
 			const env = await api.createEnvironment(project.projectId, stage);
 			environmentId = env.environmentId;
 		} else environmentId = result.environment.environmentId;
-		logger$1.log(`   ✓ Created project: ${project.projectId}`);
+		logger$3.log(`   ✓ Created project: ${project.projectId}`);
 	}
-	logger$1.log("\n📋 Loading deploy state...");
+	logger$3.log("\n📋 Loading deploy state...");
 	const stateProvider = await createStateProvider({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
@@ -5674,27 +5691,27 @@ async function workspaceDeployCommand(workspace, options) {
 	});
 	let state = await stateProvider.read(stage);
 	if (state) {
-		logger$1.log(`   Found existing state for stage "${stage}"`);
+		logger$3.log(`   Found existing state for stage "${stage}"`);
 		if (state.projectId !== project.projectId) {
-			logger$1.log(`   ⚠ Project ID changed, updating state`);
+			logger$3.log(`   ⚠ Project ID changed, updating state`);
 			state.projectId = project.projectId;
 		}
 		if (state.environmentId !== environmentId) {
-			logger$1.log(`   ⚠ Environment ID changed, updating state`);
+			logger$3.log(`   ⚠ Environment ID changed, updating state`);
 			state.environmentId = environmentId;
 		}
 	} else {
-		logger$1.log(`   Creating new state for stage "${stage}"`);
+		logger$3.log(`   Creating new state for stage "${stage}"`);
 		state = createEmptyState(stage, project.projectId, environmentId);
 	}
-	logger$1.log("\n🐳 Checking registry...");
+	logger$3.log("\n🐳 Checking registry...");
 	let registryId = await getDokployRegistryId();
 	const registry = workspace.deploy.dokploy?.registry;
 	if (registryId) try {
 		const reg = await api.getRegistry(registryId);
-		logger$1.log(`   Using registry: ${reg.registryName}`);
+		logger$3.log(`   Using registry: ${reg.registryName}`);
 	} catch {
-		logger$1.log("   ⚠ Stored registry not found, clearing...");
+		logger$3.log("   ⚠ Stored registry not found, clearing...");
 		registryId = void 0;
 		await storeDokployRegistryId("");
 	}
@@ -5703,17 +5720,17 @@ async function workspaceDeployCommand(workspace, options) {
 		if (registries.length > 0) {
 			registryId = registries[0].registryId;
 			await storeDokployRegistryId(registryId);
-			logger$1.log(`   Using registry: ${registries[0].registryName}`);
+			logger$3.log(`   Using registry: ${registries[0].registryName}`);
 		} else if (registry) {
-			logger$1.log("   No registries found in Dokploy. Let's create one.");
-			logger$1.log(`   Registry URL: ${registry}`);
+			logger$3.log("   No registries found in Dokploy. Let's create one.");
+			logger$3.log(`   Registry URL: ${registry}`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
 			const reg = await api.createRegistry("Default Registry", registry, username, password);
 			registryId = reg.registryId;
 			await storeDokployRegistryId(registryId);
-			logger$1.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$1.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
+			logger$3.log(`   ✓ Registry created: ${registryId}`);
+		} else logger$3.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
 	}
 	const services = workspace.services;
 	const dockerServices = {
@@ -5723,7 +5740,7 @@ async function workspaceDeployCommand(workspace, options) {
 	let provisionedPostgres = null;
 	let provisionedRedis = null;
 	if (dockerServices.postgres || dockerServices.redis) {
-		logger$1.log("\n🔧 Provisioning infrastructure services...");
+		logger$3.log("\n🔧 Provisioning infrastructure services...");
 		const existingServiceIds = {
 			postgresId: getPostgresId(state),
 			redisId: getRedisId(state)
@@ -5749,13 +5766,13 @@ async function workspaceDeployCommand(workspace, options) {
 			return requirements?.requiredEnvVars.includes("DATABASE_URL");
 		});
 		if (appsNeedingDb.length > 0) {
-			logger$1.log(`\n🔐 Setting up per-app database credentials...`);
-			logger$1.log(`   Apps needing DATABASE_URL: ${appsNeedingDb.join(", ")}`);
+			logger$3.log(`\n🔐 Setting up per-app database credentials...`);
+			logger$3.log(`   Apps needing DATABASE_URL: ${appsNeedingDb.join(", ")}`);
 			const existingCredentials = getAllAppCredentials(state);
 			const usersToCreate = [];
 			for (const appName of appsNeedingDb) {
 				let credentials = existingCredentials[appName];
-				if (credentials) logger$1.log(`   ${appName}: Using existing credentials from state`);
+				if (credentials) logger$3.log(`   ${appName}: Using existing credentials from state`);
 				else {
 					const password = randomBytes(16).toString("hex");
 					credentials = {
@@ -5763,7 +5780,7 @@ async function workspaceDeployCommand(workspace, options) {
 						dbPassword: password
 					};
 					setAppCredentials(state, appName, credentials);
-					logger$1.log(`   ${appName}: Generated new credentials`);
+					logger$3.log(`   ${appName}: Generated new credentials`);
 				}
 				perAppDbCredentials.set(appName, credentials);
 				usersToCreate.push({
@@ -5777,8 +5794,8 @@ async function workspaceDeployCommand(workspace, options) {
 		}
 	}
 	if (workspace.deploy?.backups && provisionedPostgres) {
-		logger$1.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-BIArpmTr.mjs");
+		logger$3.log("\n💾 Provisioning backup destination...");
+		const { provisionBackupDestination } = await import("./backup-provisioner-BEXoHTuC.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -5786,13 +5803,13 @@ async function workspaceDeployCommand(workspace, options) {
 			stage,
 			config: workspace.deploy.backups,
 			existingState: getBackupState(state),
-			logger: logger$1
+			logger: logger$3
 		});
 		setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
-			logger$1.log("   Creating postgres backup schedule...");
+			logger$3.log("   Creating postgres backup schedule...");
 			const backup = await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
@@ -5803,8 +5820,8 @@ async function workspaceDeployCommand(workspace, options) {
 				keepLatestCount: backupRetention
 			});
 			setPostgresBackupId(state, backup.backupId);
-			logger$1.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
-		} else logger$1.log("   ✓ Using existing postgres backup schedule");
+			logger$3.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger$3.log("   ✓ Using existing postgres backup schedule");
 	}
 	const publicUrls = {};
 	const results = [];
@@ -5819,25 +5836,25 @@ async function workspaceDeployCommand(workspace, options) {
 		frontendUrls.push(`https://${hostname}`);
 	}
 	if (backendApps.length > 0) {
-		logger$1.log("\n📦 PHASE 1: Deploying backend applications...");
+		logger$3.log("\n📦 PHASE 1: Deploying backend applications...");
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
-			logger$1.log(`\n   ⚙️  Deploying ${appName}...`);
+			logger$3.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
 				const dokployAppName = appName;
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
-					logger$1.log(`      Using cached ID: ${cachedAppId}`);
+					logger$3.log(`      Using cached ID: ${cachedAppId}`);
 					application = await api.getApplication(cachedAppId);
-					if (application) logger$1.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$1.log(`      ⚠ Cached ID invalid, will create new`);
+					if (application) logger$3.log(`      ✓ Application found: ${application.applicationId}`);
+					else logger$3.log(`      ⚠ Cached ID invalid, will create new`);
 				}
 				if (!application) {
 					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
 					application = result.application;
-					if (result.created) logger$1.log(`      Created application: ${application.applicationId}`);
-					else logger$1.log(`      Found existing application: ${application.applicationId}`);
+					if (result.created) logger$3.log(`      Created application: ${application.applicationId}`);
+					else logger$3.log(`      Found existing application: ${application.applicationId}`);
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const appSecrets = encryptedSecrets.get(appName);
@@ -5845,11 +5862,11 @@ async function workspaceDeployCommand(workspace, options) {
 				if (appSecrets && appSecrets.secretCount > 0) {
 					buildArgs.push(`GKM_ENCRYPTED_CREDENTIALS=${appSecrets.payload.encrypted}`);
 					buildArgs.push(`GKM_CREDENTIALS_IV=${appSecrets.payload.iv}`);
-					logger$1.log(`      Encrypted ${appSecrets.secretCount} secrets`);
+					logger$3.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				}
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$1.log(`      Building Docker image: ${imageRef}`);
+				logger$3.log(`      Building Docker image: ${imageRef}`);
 				await deployDocker({
 					stage,
 					tag: imageTag,
@@ -5899,10 +5916,10 @@ async function workspaceDeployCommand(workspace, options) {
 				const { valid, missing, resolved } = validateEnvVars(requiredVars, envContext);
 				if (!valid) throw new Error(formatMissingVarsError(appName, missing, stage));
 				const envVars = Object.entries(resolved).map(([key, value]) => `${key}=${value}`);
-				if (Object.keys(resolved).length > 0) logger$1.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				if (Object.keys(resolved).length > 0) logger$3.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
 				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger$1.log(`      Deploying to Dokploy...`);
+				logger$3.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
 				const existingDomains = await api.getDomainsByApplicationId(application.applicationId);
 				const existingDomain = existingDomains.find((d) => d.host === backendHost);
@@ -5910,7 +5927,7 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, backendHost);
 					appDomainIds.set(appName, existingDomain.domainId);
 					publicUrls[appName] = `https://${backendHost}`;
-					logger$1.log(`      ✓ Domain: https://${backendHost} (existing)`);
+					logger$3.log(`      ✓ Domain: https://${backendHost} (existing)`);
 				} else try {
 					const domain = await api.createDomain({
 						host: backendHost,
@@ -5922,10 +5939,10 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, backendHost);
 					appDomainIds.set(appName, domain.domainId);
 					publicUrls[appName] = `https://${backendHost}`;
-					logger$1.log(`      ✓ Domain: https://${backendHost} (created)`);
+					logger$3.log(`      ✓ Domain: https://${backendHost} (created)`);
 				} catch (domainError) {
 					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$1.log(`      ⚠ Domain creation failed: ${message}`);
+					logger$3.log(`      ⚠ Domain creation failed: ${message}`);
 					appHostnames.set(appName, backendHost);
 					publicUrls[appName] = `https://${backendHost}`;
 				}
@@ -5936,10 +5953,10 @@ async function workspaceDeployCommand(workspace, options) {
 					applicationId: application.applicationId,
 					imageRef
 				});
-				logger$1.log(`      ✓ ${appName} deployed successfully`);
+				logger$3.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : "Unknown error";
-				logger$1.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+				logger$3.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 				results.push({
 					appName,
 					type: app.type,
@@ -5951,25 +5968,25 @@ async function workspaceDeployCommand(workspace, options) {
 		}
 	}
 	if (frontendApps.length > 0) {
-		logger$1.log("\n🌐 PHASE 2: Deploying frontend applications...");
+		logger$3.log("\n🌐 PHASE 2: Deploying frontend applications...");
 		for (const appName of frontendApps) {
 			const app = workspace.apps[appName];
-			logger$1.log(`\n   🌐 Deploying ${appName}...`);
+			logger$3.log(`\n   🌐 Deploying ${appName}...`);
 			try {
 				const dokployAppName = appName;
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
-					logger$1.log(`      Using cached ID: ${cachedAppId}`);
+					logger$3.log(`      Using cached ID: ${cachedAppId}`);
 					application = await api.getApplication(cachedAppId);
-					if (application) logger$1.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$1.log(`      ⚠ Cached ID invalid, will create new`);
+					if (application) logger$3.log(`      ✓ Application found: ${application.applicationId}`);
+					else logger$3.log(`      ⚠ Cached ID invalid, will create new`);
 				}
 				if (!application) {
 					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
 					application = result.application;
-					if (result.created) logger$1.log(`      Created application: ${application.applicationId}`);
-					else logger$1.log(`      Found existing application: ${application.applicationId}`);
+					if (result.created) logger$3.log(`      Created application: ${application.applicationId}`);
+					else logger$3.log(`      Found existing application: ${application.applicationId}`);
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const dependencyUrls = {};
@@ -5991,17 +6008,17 @@ async function workspaceDeployCommand(workspace, options) {
 				const sniffedVars = sniffedApps.get(appName)?.requiredEnvVars ?? [];
 				const { valid, missing, resolved } = validateEnvVars(sniffedVars, envContext);
 				if (!valid) throw new Error(formatMissingVarsError(appName, missing, stage));
-				if (Object.keys(resolved).length > 0) logger$1.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				if (Object.keys(resolved).length > 0) logger$3.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
 				const buildArgs = [];
 				const publicUrlArgNames = [];
 				for (const [key, value] of Object.entries(resolved)) if (key.startsWith("NEXT_PUBLIC_")) {
 					buildArgs.push(`${key}=${value}`);
 					publicUrlArgNames.push(key);
 				}
-				if (buildArgs.length > 0) logger$1.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
+				if (buildArgs.length > 0) logger$3.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$1.log(`      Building Docker image: ${imageRef}`);
+				logger$3.log(`      Building Docker image: ${imageRef}`);
 				await deployDocker({
 					stage,
 					tag: imageTag,
@@ -6022,7 +6039,7 @@ async function workspaceDeployCommand(workspace, options) {
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
 				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger$1.log(`      Deploying to Dokploy...`);
+				logger$3.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
 				const existingFrontendDomains = await api.getDomainsByApplicationId(application.applicationId);
 				const existingFrontendDomain = existingFrontendDomains.find((d) => d.host === frontendHost);
@@ -6030,7 +6047,7 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, frontendHost);
 					appDomainIds.set(appName, existingFrontendDomain.domainId);
 					publicUrls[appName] = `https://${frontendHost}`;
-					logger$1.log(`      ✓ Domain: https://${frontendHost} (existing)`);
+					logger$3.log(`      ✓ Domain: https://${frontendHost} (existing)`);
 				} else try {
 					const domain = await api.createDomain({
 						host: frontendHost,
@@ -6042,10 +6059,10 @@ async function workspaceDeployCommand(workspace, options) {
 					appHostnames.set(appName, frontendHost);
 					appDomainIds.set(appName, domain.domainId);
 					publicUrls[appName] = `https://${frontendHost}`;
-					logger$1.log(`      ✓ Domain: https://${frontendHost} (created)`);
+					logger$3.log(`      ✓ Domain: https://${frontendHost} (created)`);
 				} catch (domainError) {
 					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$1.log(`      ⚠ Domain creation failed: ${message}`);
+					logger$3.log(`      ⚠ Domain creation failed: ${message}`);
 					appHostnames.set(appName, frontendHost);
 					publicUrls[appName] = `https://${frontendHost}`;
 				}
@@ -6056,10 +6073,10 @@ async function workspaceDeployCommand(workspace, options) {
 					applicationId: application.applicationId,
 					imageRef
 				});
-				logger$1.log(`      ✓ ${appName} deployed successfully`);
+				logger$3.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : "Unknown error";
-				logger$1.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+				logger$3.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 				results.push({
 					appName,
 					type: app.type,
@@ -6069,9 +6086,9 @@ async function workspaceDeployCommand(workspace, options) {
 			}
 		}
 	}
-	logger$1.log("\n📋 Saving deploy state...");
+	logger$3.log("\n📋 Saving deploy state...");
 	await stateProvider.write(stage, state);
-	logger$1.log("   ✓ State saved");
+	logger$3.log("   ✓ State saved");
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, creds.endpoint);
@@ -6080,27 +6097,27 @@ async function workspaceDeployCommand(workspace, options) {
 			await stateProvider.write(stage, state);
 		}
 		if (dnsResult?.success && appHostnames.size > 0) {
-			logger$1.log("\n🔒 Validating domains for SSL certificates...");
+			logger$3.log("\n🔒 Validating domains for SSL certificates...");
 			for (const [appName, hostname] of appHostnames) try {
 				const result = await api.validateDomain(hostname);
-				if (result.isValid) logger$1.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
-				else logger$1.log(`   ⚠ ${appName}: ${hostname} not valid`);
+				if (result.isValid) logger$3.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+				else logger$3.log(`   ⚠ ${appName}: ${hostname} not valid`);
 			} catch (validationError) {
 				const message = validationError instanceof Error ? validationError.message : "Unknown error";
-				logger$1.log(`   ⚠ ${appName}: validation failed - ${message}`);
+				logger$3.log(`   ⚠ ${appName}: validation failed - ${message}`);
 			}
 		}
 	}
 	const successCount = results.filter((r) => r.success).length;
 	const failedCount = results.filter((r) => !r.success).length;
-	logger$1.log(`\n${"─".repeat(50)}`);
-	logger$1.log(`\n✅ Workspace deployment complete!`);
-	logger$1.log(`   Project: ${project.projectId}`);
-	logger$1.log(`   Successful: ${successCount}`);
-	if (failedCount > 0) logger$1.log(`   Failed: ${failedCount}`);
+	logger$3.log(`\n${"─".repeat(50)}`);
+	logger$3.log(`\n✅ Workspace deployment complete!`);
+	logger$3.log(`   Project: ${project.projectId}`);
+	logger$3.log(`   Successful: ${successCount}`);
+	if (failedCount > 0) logger$3.log(`   Failed: ${failedCount}`);
 	if (Object.keys(publicUrls).length > 0) {
-		logger$1.log("\n   📡 Deployed URLs:");
-		for (const [name$1, url] of Object.entries(publicUrls)) logger$1.log(`      ${name$1}: ${url}`);
+		logger$3.log("\n   📡 Deployed URLs:");
+		for (const [name$1, url] of Object.entries(publicUrls)) logger$3.log(`      ${name$1}: ${url}`);
 	}
 	return {
 		apps: results,
@@ -6116,14 +6133,14 @@ async function deployCommand(options) {
 	const { provider, stage, tag, skipPush, skipBuild } = options;
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$1.log("📦 Detected workspace configuration");
+		logger$3.log("📦 Detected workspace configuration");
 		return workspaceDeployCommand(loadedConfig.workspace, options);
 	}
-	logger$1.log(`\n🚀 Deploying to ${provider}...`);
-	logger$1.log(`   Stage: ${stage}`);
+	logger$3.log(`\n🚀 Deploying to ${provider}...`);
+	logger$3.log(`   Stage: ${stage}`);
 	const config$1 = await loadConfig();
 	const imageTag = tag ?? generateTag(stage);
-	logger$1.log(`   Tag: ${imageTag}`);
+	logger$3.log(`   Tag: ${imageTag}`);
 	const dockerConfig = resolveDockerConfig(config$1);
 	const imageName = dockerConfig.imageName;
 	const registry = dockerConfig.registry;
@@ -6132,7 +6149,7 @@ async function deployCommand(options) {
 	let finalRegistry = registry;
 	if (provider === "dokploy") {
 		const composeServices = config$1.docker?.compose?.services;
-		logger$1.log(`\n🔍 Docker compose config: ${JSON.stringify(config$1.docker?.compose)}`);
+		logger$3.log(`\n🔍 Docker compose config: ${JSON.stringify(config$1.docker?.compose)}`);
 		const dockerServices = composeServices ? Array.isArray(composeServices) ? {
 			postgres: composeServices.includes("postgres"),
 			redis: composeServices.includes("redis"),
@@ -6149,7 +6166,7 @@ async function deployCommand(options) {
 			const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1, initStageSecrets } = await import("./storage-Dx_jZbq6.mjs");
 			let secrets = await readStageSecrets$1(stage);
 			if (!secrets) {
-				logger$1.log(`   Creating secrets file for stage "${stage}"...`);
+				logger$3.log(`   Creating secrets file for stage "${stage}"...`);
 				secrets = initStageSecrets(stage);
 			}
 			let updated = false;
@@ -6164,12 +6181,12 @@ async function deployCommand(options) {
 					const urlKey = key;
 					if (!secrets.urls[urlKey]) {
 						secrets.urls[urlKey] = value;
-						logger$1.log(`   Saved ${key} to secrets.urls`);
+						logger$3.log(`   Saved ${key} to secrets.urls`);
 						updated = true;
 					}
 				} else if (!secrets.custom[key]) {
 					secrets.custom[key] = value;
-					logger$1.log(`   Saved ${key} to secrets.custom`);
+					logger$3.log(`   Saved ${key} to secrets.custom`);
 					updated = true;
 				}
 			}
@@ -6178,14 +6195,14 @@ async function deployCommand(options) {
 	}
 	let masterKey;
 	if (!skipBuild) {
-		logger$1.log(`\n📦 Building for production...`);
+		logger$3.log(`\n📦 Building for production...`);
 		const buildResult = await buildCommand({
 			provider: "server",
 			production: true,
 			stage
 		});
 		masterKey = buildResult.masterKey;
-	} else logger$1.log(`\n⏭️  Skipping build (--skip-build)`);
+	} else logger$3.log(`\n⏭️  Skipping build (--skip-build)`);
 	let result;
 	switch (provider) {
 		case "docker": {
@@ -6221,8 +6238,8 @@ async function deployCommand(options) {
 			break;
 		}
 		case "aws-lambda": {
-			logger$1.log("\n⚠️  AWS Lambda deployment is not yet implemented.");
-			logger$1.log("   Use SST or AWS CDK for Lambda deployments.");
+			logger$3.log("\n⚠️  AWS Lambda deployment is not yet implemented.");
+			logger$3.log("   Use SST or AWS CDK for Lambda deployments.");
 			result = {
 				imageRef,
 				masterKey
@@ -6231,7 +6248,7 @@ async function deployCommand(options) {
 		}
 		default: throw new Error(`Unknown deploy provider: ${provider}\nSupported providers: docker, dokploy, aws-lambda`);
 	}
-	logger$1.log("\n✅ Deployment complete!");
+	logger$3.log("\n✅ Deployment complete!");
 	return result;
 }
 
@@ -6403,123 +6420,6 @@ function printStateDetails(state) {
 	}
 }
 
-//#endregion
-//#region src/secrets/generator.ts
-/**
-* Generate a secure random password using URL-safe base64 characters.
-* @param length Password length (default: 32)
-*/
-function generateSecurePassword(length = 32) {
-	return randomBytes(Math.ceil(length * 3 / 4)).toString("base64url").slice(0, length);
-}
-/** Default service configurations */
-const SERVICE_DEFAULTS = {
-	postgres: {
-		host: "postgres",
-		port: 5432,
-		username: "app",
-		database: "app"
-	},
-	redis: {
-		host: "redis",
-		port: 6379,
-		username: "default"
-	},
-	rabbitmq: {
-		host: "rabbitmq",
-		port: 5672,
-		username: "app",
-		vhost: "/"
-	}
-};
-/**
-* Generate credentials for a specific service.
-*/
-function generateServiceCredentials(service) {
-	const defaults = SERVICE_DEFAULTS[service];
-	return {
-		...defaults,
-		password: generateSecurePassword()
-	};
-}
-/**
-* Generate credentials for multiple services.
-*/
-function generateServicesCredentials(services) {
-	const result = {};
-	for (const service of services) result[service] = generateServiceCredentials(service);
-	return result;
-}
-/**
-* Generate connection URL for PostgreSQL.
-*/
-function generatePostgresUrl(creds) {
-	const { username, password, host, port, database } = creds;
-	return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
-}
-/**
-* Generate connection URL for Redis.
-*/
-function generateRedisUrl(creds) {
-	const { password, host, port } = creds;
-	return `redis://:${encodeURIComponent(password)}@${host}:${port}`;
-}
-/**
-* Generate connection URL for RabbitMQ.
-*/
-function generateRabbitmqUrl(creds) {
-	const { username, password, host, port, vhost } = creds;
-	const encodedVhost = encodeURIComponent(vhost ?? "/");
-	return `amqp://${username}:${encodeURIComponent(password)}@${host}:${port}/${encodedVhost}`;
-}
-/**
-* Generate connection URLs from service credentials.
-*/
-function generateConnectionUrls(services) {
-	const urls = {};
-	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
-	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
-	if (services.rabbitmq) urls.RABBITMQ_URL = generateRabbitmqUrl(services.rabbitmq);
-	return urls;
-}
-/**
-* Create a new StageSecrets object with generated credentials.
-*/
-function createStageSecrets(stage, services) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const serviceCredentials = generateServicesCredentials(services);
-	const urls = generateConnectionUrls(serviceCredentials);
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: serviceCredentials,
-		urls,
-		custom: {}
-	};
-}
-/**
-* Rotate password for a specific service.
-*/
-function rotateServicePassword(secrets, service) {
-	const currentCreds = secrets.services[service];
-	if (!currentCreds) throw new Error(`Service "${service}" not configured in secrets`);
-	const newCreds = {
-		...currentCreds,
-		password: generateSecurePassword()
-	};
-	const newServices = {
-		...secrets.services,
-		[service]: newCreds
-	};
-	return {
-		...secrets,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		services: newServices,
-		urls: generateConnectionUrls(newServices)
-	};
-}
-
 //#endregion
 //#region src/init/versions.ts
 const require$1 = createRequire(import.meta.url);
@@ -6545,14 +6445,14 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/audit": "~1.0.0",
 	"@geekmidas/auth": "~1.0.0",
 	"@geekmidas/cache": "~1.0.0",
-	"@geekmidas/client": "~2.0.0",
+	"@geekmidas/client": "~3.0.0",
 	"@geekmidas/cloud": "~1.0.0",
-	"@geekmidas/constructs": "~1.1.1",
+	"@geekmidas/constructs": "~2.0.0",
 	"@geekmidas/db": "~1.0.0",
 	"@geekmidas/emailkit": "~1.0.0",
 	"@geekmidas/envkit": "~1.0.3",
 	"@geekmidas/errors": "~1.0.0",
-	"@geekmidas/events": "~1.0.0",
+	"@geekmidas/events": "~1.1.0",
 	"@geekmidas/logger": "~1.0.0",
 	"@geekmidas/rate-limit": "~1.0.0",
 	"@geekmidas/schema": "~1.0.0",
@@ -6560,7 +6460,7 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/storage": "~1.0.0",
 	"@geekmidas/studio": "~1.0.0",
 	"@geekmidas/telescope": "~1.0.0",
-	"@geekmidas/testkit": "~1.0.1",
+	"@geekmidas/testkit": "~1.0.2",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -10664,25 +10564,77 @@ function getRunCommand(pkgManager, script) {
 		default: return `npm run ${script}`;
 	}
 }
-
-//#endregion
-//#region src/init/index.ts
+const lockfileByPm = {
+	pnpm: "pnpm-lock.yaml",
+	yarn: "yarn.lock",
+	npm: "package-lock.json",
+	bun: "bun.lockb"
+};
 /**
-* Generate a secure random password for database users
+* Find the workspace/project root by walking up from cwd.
+* Checks for PM-specific workspace config, package.json#workspaces,
+* and lockfiles.
 */
-function generateDbPassword() {
-	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+function findWorkspaceRoot(cwd, pm) {
+	let dir = cwd;
+	const root = parse(dir).root;
+	const lockfile = lockfileByPm[pm];
+	while (dir !== root) {
+		if (pm === "pnpm" && existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
+		const pkgJsonPath = join(dir, "package.json");
+		if (existsSync(pkgJsonPath)) try {
+			const pkg$1 = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+			if (pkg$1.workspaces) return dir;
+		} catch {}
+		if (existsSync(join(dir, lockfile))) return dir;
+		dir = dirname(dir);
+	}
+	return cwd;
 }
 /**
-* Generate database URL for an app
-* All apps connect to the same database, but use different users/schemas
+* Get workspace package glob patterns from pnpm-workspace.yaml
+* or package.json#workspaces.
 */
-function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
-	const userName = appName.replace(/-/g, "_");
-	const dbName = `${projectName.replace(/-/g, "_")}_dev`;
-	return `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;
+function getWorkspaceGlobs(root) {
+	const pnpmWorkspacePath = join(root, "pnpm-workspace.yaml");
+	if (existsSync(pnpmWorkspacePath)) {
+		const content = readFileSync(pnpmWorkspacePath, "utf-8");
+		const parsed = parse$1(content);
+		return parsed?.packages ?? [];
+	}
+	const rootPkgJsonPath = join(root, "package.json");
+	if (existsSync(rootPkgJsonPath)) {
+		const pkg$1 = JSON.parse(readFileSync(rootPkgJsonPath, "utf-8"));
+		if (Array.isArray(pkg$1.workspaces)) return pkg$1.workspaces;
+		if (pkg$1.workspaces?.packages) return pkg$1.workspaces.packages;
+	}
+	return [];
 }
 /**
+* Find all package.json files across a workspace.
+* Returns the root package.json plus all workspace member package.json paths.
+*/
+function findWorkspacePackages(cwd, pm) {
+	const workspaceRoot = findWorkspaceRoot(cwd, pm);
+	const results = [];
+	const rootPkgJson = join(workspaceRoot, "package.json");
+	if (existsSync(rootPkgJson)) results.push(rootPkgJson);
+	const globs = getWorkspaceGlobs(workspaceRoot);
+	for (const glob of globs) {
+		const pattern = `${glob}/package.json`;
+		const matches = fg.sync(pattern, {
+			cwd: workspaceRoot,
+			absolute: true,
+			ignore: ["**/node_modules/**"]
+		});
+		results.push(...matches);
+	}
+	return [...new Set(results)];
+}
+
+//#endregion
+//#region src/init/index.ts
+/**
 * Main init command - scaffolds a new project
 */
 async function initCommand(projectName, options = {}) {
@@ -10984,7 +10936,7 @@ function printNextSteps(projectName, options, pkgManager) {
 
 //#endregion
 //#region src/secrets/index.ts
-const logger = console;
+const logger$2 = console;
 /**
 * Extract service names from compose config.
 */
@@ -11000,23 +10952,33 @@ function getServicesFromConfig(services) {
 async function secretsInitCommand(options) {
 	const { stage, force } = options;
 	if (!force && secretsExist(stage)) {
-		logger.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
+		logger$2.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
 		process.exit(1);
 	}
 	const config$1 = await loadConfig();
 	const services = getServicesFromConfig(config$1.docker?.compose?.services);
-	if (services.length === 0) logger.warn("No services configured in docker.compose.services. Creating secrets with empty services.");
+	if (services.length === 0) logger$2.warn("No services configured in docker.compose.services. Creating secrets with empty services.");
 	const secrets = createStageSecrets(stage, services);
+	try {
+		const loaded = await loadWorkspaceConfig();
+		const isMultiApp = Object.keys(loaded.workspace.apps).length > 1;
+		if (isMultiApp) {
+			const customSecrets = generateFullstackCustomSecrets(loaded.workspace);
+			secrets.custom = customSecrets;
+			logger$2.log("  Detected workspace mode — generating per-app secrets");
+		}
+	} catch {}
 	await writeStageSecrets(secrets);
-	logger.log(`\n✓ Secrets initialized for stage "${stage}"`);
-	logger.log(`  Location: .gkm/secrets/${stage}.json`);
-	logger.log("\n  Generated credentials for:");
-	for (const service of services) logger.log(`    - ${service}`);
-	if (secrets.urls.DATABASE_URL) logger.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
-	if (secrets.urls.REDIS_URL) logger.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
-	logger.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
-	logger.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
+	logger$2.log(`\n✓ Secrets initialized for stage "${stage}"`);
+	logger$2.log(`  Location: .gkm/secrets/${stage}.json`);
+	logger$2.log("\n  Generated credentials for:");
+	for (const service of services) logger$2.log(`    - ${service}`);
+	if (secrets.urls.DATABASE_URL) logger$2.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.RABBITMQ_URL) logger$2.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
+	if (Object.keys(secrets.custom).length > 0) logger$2.log(`\n  Custom secrets: ${Object.keys(secrets.custom).length}`);
+	logger$2.log(`\n  Use "gkm secrets:show --stage ${stage}" to view secrets`);
+	logger$2.log("  Use \"gkm secrets:set <KEY> <VALUE> --stage " + stage + "\" to add custom secrets");
 }
 /**
 * Read all data from stdin.
@@ -11035,21 +10997,21 @@ async function secretsSetCommand(key, value, options) {
 	let secretValue = value;
 	if (!secretValue) {
 		if (process.stdin.isTTY) {
-			logger.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
-			logger.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
+			logger$2.error("No value provided. Use: gkm secrets:set KEY VALUE --stage <stage>");
+			logger$2.error("Or pipe from stdin: echo \"value\" | gkm secrets:set KEY --stage <stage>");
 			process.exit(1);
 		}
 		secretValue = await readStdin();
 		if (!secretValue) {
-			logger.error("No value received from stdin");
+			logger$2.error("No value received from stdin");
 			process.exit(1);
 		}
 	}
 	try {
 		await setCustomSecret(stage, key, secretValue);
-		logger.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
+		logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}"`);
 	} catch (error) {
-		logger.error(error instanceof Error ? error.message : "Failed to set secret");
+		logger$2.error(error instanceof Error ? error.message : "Failed to set secret");
 		process.exit(1);
 	}
 }
@@ -11060,32 +11022,32 @@ async function secretsShowCommand(options) {
 	const { stage, reveal } = options;
 	const secrets = await readStageSecrets(stage);
 	if (!secrets) {
-		logger.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
-	logger.log(`\nSecrets for stage "${stage}":`);
-	logger.log(`  Created: ${secrets.createdAt}`);
-	logger.log(`  Updated: ${secrets.updatedAt}`);
-	logger.log("\nService Credentials:");
+	logger$2.log(`\nSecrets for stage "${stage}":`);
+	logger$2.log(`  Created: ${secrets.createdAt}`);
+	logger$2.log(`  Updated: ${secrets.updatedAt}`);
+	logger$2.log("\nService Credentials:");
 	for (const [service, creds] of Object.entries(secrets.services)) if (creds) {
-		logger.log(`\n  ${service}:`);
-		logger.log(`    host: ${creds.host}`);
-		logger.log(`    port: ${creds.port}`);
-		logger.log(`    username: ${creds.username}`);
-		logger.log(`    password: ${reveal ? creds.password : maskPassword(creds.password)}`);
-		if (creds.database) logger.log(`    database: ${creds.database}`);
-		if (creds.vhost) logger.log(`    vhost: ${creds.vhost}`);
-	}
-	logger.log("\nConnection URLs:");
-	if (secrets.urls.DATABASE_URL) logger.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
-	if (secrets.urls.REDIS_URL) logger.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
-	if (secrets.urls.RABBITMQ_URL) logger.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
+		logger$2.log(`\n  ${service}:`);
+		logger$2.log(`    host: ${creds.host}`);
+		logger$2.log(`    port: ${creds.port}`);
+		logger$2.log(`    username: ${creds.username}`);
+		logger$2.log(`    password: ${reveal ? creds.password : maskPassword(creds.password)}`);
+		if (creds.database) logger$2.log(`    database: ${creds.database}`);
+		if (creds.vhost) logger$2.log(`    vhost: ${creds.vhost}`);
+	}
+	logger$2.log("\nConnection URLs:");
+	if (secrets.urls.DATABASE_URL) logger$2.log(`  DATABASE_URL: ${reveal ? secrets.urls.DATABASE_URL : maskUrl(secrets.urls.DATABASE_URL)}`);
+	if (secrets.urls.REDIS_URL) logger$2.log(`  REDIS_URL: ${reveal ? secrets.urls.REDIS_URL : maskUrl(secrets.urls.REDIS_URL)}`);
+	if (secrets.urls.RABBITMQ_URL) logger$2.log(`  RABBITMQ_URL: ${reveal ? secrets.urls.RABBITMQ_URL : maskUrl(secrets.urls.RABBITMQ_URL)}`);
 	const customKeys = Object.keys(secrets.custom);
 	if (customKeys.length > 0) {
-		logger.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger.log(`  ${key}: ${reveal ? value : maskPassword(value)}`);
+		logger$2.log("\nCustom Secrets:");
+		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : maskPassword(value)}`);
 	}
-	if (!reveal) logger.log("\nUse --reveal to show actual values");
+	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
 }
 /**
 * Rotate passwords for services.
@@ -11094,25 +11056,25 @@ async function secretsRotateCommand(options) {
 	const { stage, service } = options;
 	const secrets = await readStageSecrets(stage);
 	if (!secrets) {
-		logger.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
 	if (service) {
 		if (!secrets.services[service]) {
-			logger.error(`Service "${service}" not configured in stage "${stage}"`);
+			logger$2.error(`Service "${service}" not configured in stage "${stage}"`);
 			process.exit(1);
 		}
 		const updated = rotateServicePassword(secrets, service);
 		await writeStageSecrets(updated);
-		logger.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
+		logger$2.log(`\n✓ Password rotated for ${service} in stage "${stage}"`);
 	} else {
 		let updated = secrets;
 		const services = Object.keys(secrets.services);
 		for (const svc of services) updated = rotateServicePassword(updated, svc);
 		await writeStageSecrets(updated);
-		logger.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
+		logger$2.log(`\n✓ Passwords rotated for all services in stage "${stage}": ${services.join(", ")}`);
 	}
-	logger.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
+	logger$2.log(`\nUse "gkm secrets:show --stage ${stage}" to view new values`);
 }
 /**
 * Import secrets from a JSON file.
@@ -11120,7 +11082,7 @@ async function secretsRotateCommand(options) {
 async function secretsImportCommand(file, options) {
 	const { stage, merge = true } = options;
 	if (!existsSync(file)) {
-		logger.error(`File not found: ${file}`);
+		logger$2.error(`File not found: ${file}`);
 		process.exit(1);
 	}
 	let importedSecrets;
@@ -11130,12 +11092,12 @@ async function secretsImportCommand(file, options) {
 		if (typeof importedSecrets !== "object" || importedSecrets === null) throw new Error("JSON must be an object");
 		for (const [key, value] of Object.entries(importedSecrets)) if (typeof value !== "string") throw new Error(`Value for "${key}" must be a string, got ${typeof value}`);
 	} catch (error) {
-		logger.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
+		logger$2.error(`Failed to parse JSON file: ${error instanceof Error ? error.message : "Invalid JSON"}`);
 		process.exit(1);
 	}
 	const secrets = await readStageSecrets(stage);
 	if (!secrets) {
-		logger.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
+		logger$2.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
 	const updatedCustom = merge ? {
@@ -11150,10 +11112,10 @@ async function secretsImportCommand(file, options) {
 	await writeStageSecrets(updated);
 	const importedCount = Object.keys(importedSecrets).length;
 	const totalCount = Object.keys(updatedCustom).length;
-	logger.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
-	if (merge && totalCount > importedCount) logger.log(`  Total custom secrets: ${totalCount}`);
-	logger.log("\n  Imported keys:");
-	for (const key of Object.keys(importedSecrets)) logger.log(`    - ${key}`);
+	logger$2.log(`\n✓ Imported ${importedCount} secrets for stage "${stage}"`);
+	if (merge && totalCount > importedCount) logger$2.log(`  Total custom secrets: ${totalCount}`);
+	logger$2.log("\n  Imported keys:");
+	for (const key of Object.keys(importedSecrets)) logger$2.log(`    - ${key}`);
 }
 /**
 * Mask password in a URL for display.
@@ -11168,6 +11130,139 @@ function maskUrl(url) {
 	}
 }
 
+//#endregion
+//#region src/setup/index.ts
+const logger$1 = console;
+/**
+* Setup development environment.
+*
+* Orchestrates:
+* 1. Load workspace config
+* 2. Resolve secrets (local → SSM → generate fresh)
+* 3. Write docker/.env from secrets
+* 4. Start Docker services
+*/
+async function setupCommand(options = {}) {
+	const stage = options.stage ?? "development";
+	logger$1.log("\n🔧 Setting up development environment...\n");
+	let loadedConfig;
+	try {
+		loadedConfig = await loadWorkspaceConfig();
+	} catch {
+		logger$1.error("❌ No gkm.config.ts found. Run this command from a workspace root.");
+		process.exit(1);
+	}
+	const { workspace } = loadedConfig;
+	const isMultiApp = Object.keys(workspace.apps).length > 1;
+	logger$1.log(`📦 Workspace: ${workspace.name}`);
+	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
+	logger$1.log(`🔑 Stage: ${stage}\n`);
+	const secrets = await resolveSecrets(stage, workspace, options);
+	if (!secrets) {
+		logger$1.error("❌ Failed to resolve secrets. Exiting.");
+		process.exit(1);
+	}
+	if (isMultiApp && workspace.services.db) {
+		await writeDockerEnvFromSecrets(secrets, workspace.root);
+		logger$1.log("📄 Generated docker/.env with database passwords");
+	}
+	if (!options.skipDocker) {
+		const composeFile = join(workspace.root, "docker-compose.yml");
+		if (existsSync(composeFile)) {
+			logger$1.log("");
+			await startWorkspaceServices(workspace);
+		} else logger$1.log("⚠️  No docker-compose.yml found. Skipping Docker services.");
+	}
+	printSummary(workspace, stage);
+}
+/**
+* Resolve secrets with priority:
+* 1. Local secrets exist → use them (preserves manual additions)
+* 2. SSM configured and has secrets → pull and use
+* 3. Neither → generate fresh secrets
+*
+* --force skips checks 1 and 2 and always regenerates.
+*/
+async function resolveSecrets(stage, workspace, options) {
+	if (options.force) {
+		logger$1.log("🔐 Generating fresh secrets (--force)...");
+		return generateFreshSecrets(stage, workspace, options);
+	}
+	if (secretsExist(stage, workspace.root)) {
+		logger$1.log("🔐 Using existing local secrets");
+		const secrets = await readStageSecrets(stage, workspace.root);
+		if (secrets) return secrets;
+	}
+	if (isSSMConfigured(workspace)) {
+		logger$1.log("☁️  Checking for remote secrets in SSM...");
+		try {
+			const remoteSecrets = await pullSecrets(stage, workspace);
+			if (remoteSecrets) {
+				logger$1.log("✅ Pulled secrets from SSM");
+				await writeStageSecrets(remoteSecrets, workspace.root);
+				return remoteSecrets;
+			}
+			logger$1.log("   No remote secrets found");
+		} catch (error) {
+			logger$1.warn(`⚠️  Failed to pull from SSM: ${error.message}`);
+		}
+	}
+	logger$1.log("🔐 Generating fresh development secrets...");
+	return generateFreshSecrets(stage, workspace, options);
+}
+/**
+* Generate fresh secrets for the workspace.
+*/
+async function generateFreshSecrets(stage, workspace, options) {
+	const serviceNames = [];
+	if (workspace.services.db) serviceNames.push("postgres");
+	if (workspace.services.cache) serviceNames.push("redis");
+	const secrets = createStageSecrets(stage, serviceNames);
+	const isMultiApp = Object.keys(workspace.apps).length > 1;
+	if (isMultiApp) {
+		const customSecrets = generateFullstackCustomSecrets(workspace);
+		secrets.custom = customSecrets;
+	} else secrets.custom = {
+		NODE_ENV: "development",
+		PORT: "3000",
+		LOG_LEVEL: "debug",
+		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
+	};
+	await writeStageSecrets(secrets, workspace.root);
+	logger$1.log(`   Secrets written to .gkm/secrets/${stage}.json`);
+	if (isSSMConfigured(workspace) && !options.yes) {
+		const { shouldPush } = await prompts({
+			type: "confirm",
+			name: "shouldPush",
+			message: "Push secrets to SSM for team sharing?",
+			initial: true
+		});
+		if (shouldPush) try {
+			await pushSecrets(stage, workspace);
+			logger$1.log("☁️  Secrets pushed to SSM");
+		} catch (error) {
+			logger$1.warn(`⚠️  Failed to push to SSM: ${error.message}`);
+		}
+	}
+	return secrets;
+}
+/**
+* Print setup summary with next steps.
+*/
+function printSummary(workspace, stage) {
+	logger$1.log(`\n${"─".repeat(50)}`);
+	logger$1.log("\n✅ Development environment ready!\n");
+	logger$1.log("📋 Apps:");
+	for (const [name$1, app] of Object.entries(workspace.apps)) {
+		const icon = app.type === "frontend" ? "🌐" : "🔧";
+		logger$1.log(`   ${icon} ${name$1} → http://localhost:${app.port}`);
+	}
+	logger$1.log("\n🚀 Next steps:");
+	logger$1.log("   gkm dev                    # Start all apps");
+	logger$1.log(`   gkm secrets:show --stage ${stage}  # View secrets`);
+	logger$1.log("");
+}
+
 //#endregion
 //#region src/test/index.ts
 /**
@@ -11304,6 +11399,146 @@ async function ensureTestDatabase(env) {
 	}
 }
 
+//#endregion
+//#region src/upgrade/index.ts
+const logger = console;
+async function upgradeCommand(options = {}) {
+	const cwd = process.cwd();
+	logger.log("\n📦 Scanning workspace for @geekmidas packages...\n");
+	const pm = detectPackageManager(cwd);
+	logger.log(`  Package manager: ${pm}`);
+	const packageJsonPaths = findWorkspacePackages(cwd, pm);
+	logger.log(`  Found ${packageJsonPaths.length} package(s) in workspace\n`);
+	const dependencies$1 = scanForGeekmidasDeps(packageJsonPaths);
+	if (dependencies$1.length === 0) {
+		logger.log("  No @geekmidas packages found.\n");
+		return;
+	}
+	const uniquePackages = [...new Set(dependencies$1.map((d) => d.packageName))];
+	logger.log(`  Checking ${uniquePackages.length} unique @geekmidas package(s) on npm...\n`);
+	const latestVersions = await fetchLatestVersions(uniquePackages);
+	const upgradeInfos = dependencies$1.map((dep) => resolveUpgradeInfo(dep, latestVersions));
+	printUpgradeTable(upgradeInfos);
+	const upgradable = upgradeInfos.filter((info) => info.needsUpgrade && !info.isWorkspaceRef);
+	if (upgradable.length === 0) {
+		logger.log("\n  All @geekmidas packages are up to date!\n");
+		return;
+	}
+	logger.log(`\n  ${upgradable.length} package(s) can be upgraded.\n`);
+	if (options.dryRun) {
+		logger.log("  --dry-run: No changes made.\n");
+		printUpgradeCommands(upgradable, pm);
+		return;
+	}
+	executeUpgrade(upgradable, pm, cwd);
+	logger.log("\n  ✅ Upgrade complete! Run your tests to verify.\n");
+}
+function scanForGeekmidasDeps(packageJsonPaths) {
+	const results = [];
+	const depTypes = [
+		"dependencies",
+		"devDependencies",
+		"peerDependencies"
+	];
+	for (const pkgJsonPath of packageJsonPaths) {
+		const pkg$1 = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+		const workspaceName = pkg$1.name ?? pkgJsonPath;
+		for (const depType of depTypes) {
+			const deps = pkg$1[depType];
+			if (!deps) continue;
+			for (const [name$1, version$1] of Object.entries(deps)) {
+				if (!name$1.startsWith("@geekmidas/")) continue;
+				results.push({
+					packageName: name$1,
+					currentVersion: version$1,
+					depType,
+					packageJsonPath: pkgJsonPath,
+					workspaceName
+				});
+			}
+		}
+	}
+	return results;
+}
+async function fetchLatestVersions(packageNames) {
+	const versions = /* @__PURE__ */ new Map();
+	const results = await Promise.allSettled(packageNames.map(async (name$1) => {
+		const res = await fetch(`https://registry.npmjs.org/${name$1}/latest`);
+		if (!res.ok) throw new Error(`HTTP ${res.status}`);
+		const data = await res.json();
+		return {
+			name: name$1,
+			version: data.version
+		};
+	}));
+	for (const result of results) if (result.status === "fulfilled") versions.set(result.value.name, result.value.version);
+	return versions;
+}
+function resolveUpgradeInfo(dep, latestVersions) {
+	const isWorkspaceRef = dep.currentVersion.startsWith("workspace:");
+	const latestVersion = latestVersions.get(dep.packageName) ?? "unknown";
+	const currentBare = dep.currentVersion.replace(/^[\^~>=<]*/g, "");
+	const needsUpgrade = !isWorkspaceRef && latestVersion !== "unknown" && currentBare !== latestVersion;
+	return {
+		...dep,
+		latestVersion,
+		isWorkspaceRef,
+		needsUpgrade
+	};
+}
+function printUpgradeTable(infos) {
+	const byPackage = /* @__PURE__ */ new Map();
+	for (const info of infos) if (!byPackage.has(info.packageName)) byPackage.set(info.packageName, info);
+	const nameWidth = 33;
+	const verWidth = 14;
+	const statusWidth = 14;
+	const hr = `  ${"─".repeat(nameWidth + verWidth * 2 + statusWidth + 5)}`;
+	logger.log(hr);
+	logger.log(`  ${"Package".padEnd(nameWidth)} ${"Current".padEnd(verWidth)} ${"Latest".padEnd(verWidth)} ${"Status".padEnd(statusWidth)}`);
+	logger.log(hr);
+	for (const [, info] of byPackage) {
+		const name$1 = info.packageName.padEnd(nameWidth);
+		const current = info.currentVersion.padEnd(verWidth);
+		const latest = info.latestVersion.padEnd(verWidth);
+		let status;
+		if (info.isWorkspaceRef) status = "workspace";
+		else if (info.needsUpgrade) status = "⬆ upgrade";
+		else status = "✓ up-to-date";
+		logger.log(`  ${name$1} ${current} ${latest} ${status}`);
+	}
+	logger.log(hr);
+}
+function printUpgradeCommands(upgradable, pm) {
+	logger.log("  Commands that would be run:\n");
+	const uniquePackages = [...new Set(upgradable.map((i) => i.packageName))];
+	const cmd = getWorkspaceUpgradeCommand(pm, uniquePackages);
+	logger.log(`    ${cmd}\n`);
+}
+function getWorkspaceUpgradeCommand(pm, packages) {
+	const pkgList = packages.join(" ");
+	switch (pm) {
+		case "pnpm": return `pnpm update -r ${pkgList} --latest`;
+		case "yarn": return `yarn upgrade ${pkgList}`;
+		case "bun": return `bun update ${pkgList}`;
+		case "npm": return `npm update ${pkgList} --workspaces`;
+		default: return `npm update ${pkgList}`;
+	}
+}
+function executeUpgrade(upgradable, pm, cwd) {
+	const uniquePackages = [...new Set(upgradable.map((i) => i.packageName))];
+	const cmd = getWorkspaceUpgradeCommand(pm, uniquePackages);
+	logger.log(`  Running: ${cmd}\n`);
+	try {
+		execSync(cmd, {
+			cwd,
+			stdio: "inherit",
+			timeout: 12e4
+		});
+	} catch {
+		throw new Error("Package upgrade failed. Check the output above for details.");
+	}
+}
+
 //#endregion
 //#region src/index.ts
 const program = new Command();
@@ -11318,6 +11553,16 @@ program.command("init").description("Scaffold a new project").argument("[name]",
 		process.exit(1);
 	}
 });
+program.command("setup").description("Setup development environment (secrets, Docker, database)").option("--stage <stage>", "Stage name", "development").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await setupCommand(options);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
 program.command("build").description("Build handlers from endpoints, functions, and crons").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -11514,6 +11759,84 @@ program.command("secrets:import").description("Import secrets from a JSON file")
 		process.exit(1);
 	}
 });
+program.command("secrets:push").description("Push secrets to remote provider (SSM)").requiredOption("--stage <stage>", "Stage name").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
+		const { pushSecrets: pushSecrets$1 } = await import("./sync-6FoT41G3.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-D2WCDQue.mjs");
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Dx_jZbq6.mjs");
+		const { workspace } = await loadWorkspaceConfig$1();
+		const secrets = await readStageSecrets$1(options.stage, workspace.root);
+		if (secrets) {
+			const result = reconcileMissingSecrets(secrets, workspace);
+			if (result) {
+				await writeStageSecrets$1(result.secrets, workspace.root);
+				console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
+				for (const key of result.addedKeys) console.log(`    + ${key}`);
+			}
+		}
+		await pushSecrets$1(options.stage, workspace);
+		console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
+program.command("secrets:pull").description("Pull secrets from remote provider (SSM)").requiredOption("--stage <stage>", "Stage name").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
+		const { pullSecrets: pullSecrets$1 } = await import("./sync-6FoT41G3.mjs");
+		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Dx_jZbq6.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-D2WCDQue.mjs");
+		const { workspace } = await loadWorkspaceConfig$1();
+		let secrets = await pullSecrets$1(options.stage, workspace);
+		if (!secrets) {
+			console.error(`No remote secrets found for stage "${options.stage}".`);
+			process.exit(1);
+		}
+		const result = reconcileMissingSecrets(secrets, workspace);
+		if (result) {
+			secrets = result.secrets;
+			console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
+			for (const key of result.addedKeys) console.log(`    + ${key}`);
+		}
+		await writeStageSecrets$1(secrets, workspace.root);
+		console.log(`\n✓ Secrets pulled for stage "${options.stage}"`);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
+program.command("secrets:reconcile").description("Backfill missing custom secrets from workspace config").option("--stage <stage>", "Stage name", "development").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-D2WCDQue.mjs");
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Dx_jZbq6.mjs");
+		const { workspace } = await loadWorkspaceConfig$1();
+		const secrets = await readStageSecrets$1(options.stage, workspace.root);
+		if (!secrets) {
+			console.error(`No secrets found for stage "${options.stage}". Run "gkm secrets:init --stage ${options.stage}" first.`);
+			process.exit(1);
+		}
+		const result = reconcileMissingSecrets(secrets, workspace);
+		if (!result) {
+			console.log(`\n✓ Secrets for stage "${options.stage}" are up-to-date`);
+			return;
+		}
+		await writeStageSecrets$1(result.secrets, workspace.root);
+		console.log(`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${options.stage}":`);
+		for (const key of result.addedKeys) console.log(`    + ${key}`);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
 program.command("deploy").description("Deploy application to a provider").requiredOption("--provider <provider>", "Deploy provider (docker, dokploy, aws-lambda)").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -11660,6 +11983,16 @@ program.command("state:diff").description("Compare local and remote deployment s
 		process.exit(1);
 	}
 });
+program.command("upgrade").description("Upgrade all @geekmidas packages to their latest versions").option("--dry-run", "Show what would be upgraded without making changes").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await upgradeCommand(options);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
 program.parse();
 
 //#endregion