@geekmidas/cli 10.0.0-alpha.64 → 10.0.0-alpha.66

package/dist/{sniffer-49KPbDgq.mjs → state-uuYqnRVO.mjs}

@@ -1,27 +1,21 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { _ as storeHostingerToken, g as storeDokployCredentials, h as removeDokployCredentials, l as getCredentialsPath, s as run$1, t as LocalSandbox, u as getDokployCredentials } from "./local-Cd8ZYQG3.mjs";
-import { d as output, r as discover, s as nodeWithTsx } from "./discover-LMrqsWSU.mjs";
-import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { s as run$1, u as gkmHome } from "./local-CWR4Y_kW.mjs";
+import { d as output, r as discover } from "./discover-BFoJWKGD.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { E as TEST_STAGE, p as getPublicEnvPrefix, t as allConstructGlobs } from "./workspace-Bwit4q9O.mjs";
+import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-Be6uBhlF.mjs";
 import { ConfigNotFound, NotInAnApp, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { i as toEmbeddableSecrets } from "./storage-BzaUxmqe.mjs";
-import { i as FileSecretsStore, n as secretsStoreFor } from "./store-BaaonhkJ.mjs";
-import { r as runtimeOf } from "./runtime-Cmn-FeYO.mjs";
+import { c as runtimeOf } from "./resolve-Db0tNlrW.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
 import { basename, dirname, join, parse, resolve } from "node:path";
-import { stdin, stdout } from "node:process";
-import * as readline from "node:readline/promises";
-import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
-import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { hostname, networkInterfaces, userInfo } from "node:os";
+import { constants, copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
+import { chmod, copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { homedir, networkInterfaces } from "node:os";
 import { promisify } from "node:util";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
-import { fileURLToPath } from "node:url";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { config } from "dotenv";
-import { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
@@ -32,189 +26,528 @@ import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/clie
 import { Client } from "pg";
 import { stringify } from "yaml";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
-//#region src/prompt.ts
-/**
-* Asking the person at the terminal.
-*
-* CLI layer only: a command's action may prompt, nothing it calls may. A
-* library call (`deploy()`) that needs something it was not given raises a
-* named error instead, and the command decides whether to ask.
-*/
-/** A prompt was needed with no terminal to ask at. */
-var PromptNeedsTerminal = class extends Error {
-	question;
-	instead;
-	constructor(question, instead) {
-		super(`Interactive input required. ${instead}`);
-		this.question = question;
-		this.instead = instead;
-		this.name = "PromptNeedsTerminal";
+//#region src/secrets/storage.ts
+var storage_exports = /* @__PURE__ */ __exportAll({
+	initStageSecrets: () => initStageSecrets,
+	maskPassword: () => maskPassword,
+	toEmbeddableSecrets: () => toEmbeddableSecrets,
+	validateEnvironmentVariables: () => validateEnvironmentVariables,
+	withCustomSecret: () => withCustomSecret
+});
+/**
+* Initialize an empty StageSecrets object for a stage.
+*/
+function initStageSecrets(stage) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: {},
+		urls: {},
+		custom: {}
+	};
+}
+/**
+* Convert StageSecrets to embeddable format (flat key-value pairs).
+* This is what gets encrypted and embedded in the bundle.
+*/
+function toEmbeddableSecrets(secrets) {
+	return {
+		...secrets.urls,
+		...secrets.custom,
+		...secrets.services.postgres && {
+			POSTGRES_USER: secrets.services.postgres.username,
+			POSTGRES_PASSWORD: secrets.services.postgres.password,
+			POSTGRES_DB: secrets.services.postgres.database ?? "app",
+			POSTGRES_HOST: secrets.services.postgres.host,
+			POSTGRES_PORT: String(secrets.services.postgres.port)
+		},
+		...secrets.services.redis && {
+			REDIS_PASSWORD: secrets.services.redis.password,
+			REDIS_HOST: secrets.services.redis.host,
+			REDIS_PORT: String(secrets.services.redis.port)
+		},
+		...secrets.services.minio && {
+			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
+			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
+			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
+			STORAGE_REGION: "eu-west-1",
+			STORAGE_FORCE_PATH_STYLE: "true"
+		},
+		...secrets.services.mailpit && {
+			SMTP_HOST: secrets.services.mailpit.host,
+			SMTP_PORT: String(secrets.services.mailpit.port),
+			SMTP_USER: secrets.services.mailpit.username,
+			SMTP_PASS: secrets.services.mailpit.password,
+			SMTP_SECURE: "false",
+			MAIL_FROM: "noreply@localhost"
+		},
+		...secrets.services.localstack && {
+			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
+			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
+			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
+			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
+		},
+		...secrets.services.pgboss && {
+			PGBOSS_DB_USER: secrets.services.pgboss.username,
+			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
+		}
+	};
+}
+/** The same secrets with one custom value set, and `updatedAt` moved on. */
+function withCustomSecret(secrets, key, value) {
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: {
+			...secrets.custom,
+			[key]: value
+		}
+	};
+}
+/**
+* Mask a password for display (show first 4 and last 2 chars).
+*/
+function maskPassword(password) {
+	if (password.length <= 8) return "********";
+	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
+}
+/**
+* Validate that all required environment variables are present in secrets.
+*
+* @param requiredVars - Array of environment variable names required by the application
+* @param secrets - Stage secrets to validate against
+* @returns Validation result with missing and provided variables
+*
+* @example
+* ```typescript
+* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
+* const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));
+* const result = validateEnvironmentVariables(required, secrets);
+*
+* if (!result.valid) {
+*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
+* }
+* ```
+*/
+function validateEnvironmentVariables(requiredVars, secrets) {
+	const embeddable = toEmbeddableSecrets(secrets);
+	const availableVars = new Set(Object.keys(embeddable));
+	const missing = [];
+	const provided = [];
+	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
+	else missing.push(varName);
+	return {
+		valid: missing.length === 0,
+		missing: missing.sort(),
+		provided: provided.sort(),
+		required: [...requiredVars].sort()
+	};
+}
+//#endregion
+//#region src/deploy/identity.ts
+/**
+* Who a deploy is, on a target it shares with other workspaces.
+*
+* A Dokploy server is one flat namespace of projects, images and Docker
+* service names. Deploys used to identify everything they made by the
+* workspace name alone, so two workspaces called `shop` — or `Shop` and
+* `shop` — deploying to one server landed in the same project, pushed over
+* each other's images and redeployed each other's applications. A
+* `DeployIdentity` is what a deploy names and claims its resources by instead.
+*/
+/** A namespace that cannot be part of a Dokploy name or an image path. */
+var DeployNamespaceInvalid = class extends Error {
+	namespace;
+	constructor(namespace) {
+		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
+		this.namespace = namespace;
+		this.name = "DeployNamespaceInvalid";
 	}
 };
-/** Whether there is a person at a terminal to ask. */
-function canPrompt() {
-	return process.stdin.isTTY === true;
-}
-/**
-* Ask `message` and resolve with the line typed — without echoing it when
-* `hidden`. Ctrl+C at a hidden prompt exits, as it would anywhere else in a
-* terminal program: raw mode has taken the signal away from the shell.
-*/
-async function prompt(message, options) {
-	if (!canPrompt()) throw new PromptNeedsTerminal(message, options.instead);
-	if (options.hidden) {
-		process.stdout.write(message);
-		return new Promise((resolve, reject) => {
-			let value = "";
-			const cleanup = () => {
-				process.stdin.setRawMode(false);
-				process.stdin.pause();
-				process.stdin.removeListener("data", onData);
-				process.stdin.removeListener("error", onError);
-			};
-			const onError = (err) => {
-				cleanup();
-				reject(err);
-			};
-			const onData = (char) => {
-				const c = char.toString();
-				if (c === "\n" || c === "\r") {
-					cleanup();
-					process.stdout.write("\n");
-					resolve(value);
-				} else if (c === "") {
-					cleanup();
-					process.stdout.write("\n");
-					process.exit(1);
-				} else if (c === "" || c === "\b") {
-					if (value.length > 0) value = value.slice(0, -1);
-				} else value += c;
-			};
-			process.stdin.setRawMode(true);
-			process.stdin.resume();
-			process.stdin.on("data", onData);
-			process.stdin.on("error", onError);
-		});
-	}
-	const rl = readline.createInterface({
-		input: stdin,
-		output: stdout
-	});
-	try {
-		return await rl.question(message);
-	} finally {
-		rl.close();
+/** A workspace name with nothing a target can name a resource by. */
+var DeployProjectNameInvalid = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
+		this.workspaceName = workspaceName;
+		this.name = "DeployProjectNameInvalid";
 	}
+};
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
+* a Docker image path component, a Docker service name and a Dokploy name.
+*/
+function slug(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** The namespace a workspace is in when it does not name one. */
+function defaultNamespace(workspaceName) {
+	return slug(kebabCase(workspaceName));
+}
+function deployIdentity(workspace, stage) {
+	const project = slug(workspace.name);
+	if (!project) throw new DeployProjectNameInvalid(workspace.name);
+	const fallback = defaultNamespace(workspace.name);
+	const namespace = workspace.deploy?.namespace ?? fallback;
+	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
+	return {
+		namespace,
+		project,
+		stage,
+		key: `${namespace}/${project}`,
+		scope: namespace === fallback ? project : `${namespace}-${project}`
+	};
+}
+/**
+* The token a Dokploy project's description carries to say which identity
+* created it. A project with the right name and no marker belongs to someone
+* else, and a deploy never adopts it.
+*/
+function ownershipMarker(identity) {
+	return `gkm:${identity.key}`;
+}
+/** Whether a project description carries `identity`'s marker. */
+function isOwnedBy(description, identity) {
+	const marker = ownershipMarker(identity);
+	return (description ?? "").split(/\s+/).includes(marker);
+}
+/** Any `gkm:` marker a description carries — whoever's it is. */
+function markerOf(description) {
+	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
+}
+/** What the Dokploy project is called. */
+function projectName(identity) {
+	return identity.scope;
+}
+/**
+* The repository an app's image is pushed to, below the registry:
+* `<namespace>/<project>-<app>`.
+*
+* The namespace is a path segment of its own so that a registry that maps
+* paths to owners (an organisation's packages, a Harbor project) can grant it
+* as one; the app is joined to the project so the two read as one name.
+*/
+function imageName(identity, app) {
+	return `${identity.namespace}/${identity.project}-${slug(kebabCase(app))}`;
+}
+/** The full image ref an app is built, pushed and deployed as. */
+function imageRef(identity, app, registry, tag) {
+	const name = imageName(identity, app);
+	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
+}
+/**
+* What one application is called on the target.
+*
+* The same rule the constructs use, through the same `scopedName`, scoped by
+* the stage and the identity: the application beside
+* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
+* Dokploy application's name is also its Docker service name, which is unique
+* on the whole server, so the namespace has to be in it too — `acme`'s and
+* `globex`'s `shop` would otherwise both run `production-shop-api`.
+*
+* The app id is dropped when it repeats the project, so a project named for its
+* one application is `production-kitchen-sink` rather than
+* `production-kitchen-sink-kitchen-sink`.
+*/
+function applicationName(identity, app) {
+	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
 }
 //#endregion
-//#region src/auth/index.ts
-const logger$2 = console;
-/**
-* Validate Dokploy token by making a test API call
-*/
-async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => dokploy_api_exports);
-	return new DokployApi({
-		baseUrl: endpoint,
-		token
-	}).validateToken();
-}
-/** What answers a login prompt without a terminal. */
-const LOGIN_INSTEAD = "Please provide --token option.";
-/**
-* Login to a service
-*/
-async function loginCommand(options) {
-	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
-	if (provider === "dokploy") {
-		logger$2.log("\n🔐 Logging in to Dokploy...\n");
-		let endpoint = providedEndpoint;
-		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: LOGIN_INSTEAD });
-		endpoint = endpoint.replace(/\/$/, "");
-		try {
-			new URL(endpoint);
-		} catch {
-			logger$2.error("Invalid URL format");
-			process.exit(1);
-		}
-		let token = providedToken;
-		if (!token) {
-			logger$2.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			token = await prompt("API Token: ", {
-				hidden: true,
-				instead: LOGIN_INSTEAD
-			});
-		}
-		if (!token) {
-			logger$2.error("Token is required");
-			process.exit(1);
-		}
-		logger$2.log("\nValidating credentials...");
-		if (!await validateDokployToken(endpoint, token)) {
-			logger$2.error("\n✗ Invalid credentials. Please check your token and try again.");
-			process.exit(1);
-		}
-		await storeDokployCredentials(token, endpoint);
-		logger$2.log("\n✓ Successfully logged in to Dokploy!");
-		logger$2.log(`  Endpoint: ${endpoint}`);
-		logger$2.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger$2.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+//#region src/secrets/keystore.ts
+/**
+* The keys that open each stage's encrypted secrets file, kept outside the
+* project in the CLI's home.
+*
+* Keys were kept at `~/.gkm/<folder>/<stage>.key`, named after the project
+* directory — so two checkouts in folders with the same name (`~/work/api`
+* and `~/oss/api`) shared one key, and the second `gkm secrets:init`
+* overwrote the first project's. They are now kept under the project's
+* identity, `<home>/keys/<namespace>/<project>/<stage>.key`, the same
+* `<namespace>/<project>` a deploy claims its Dokploy project by. A key still
+* at the old place is copied to the new one the first time it is read; the
+* old file stays, so an older CLI on the same machine keeps working.
+*/
+/** Key length for AES-256 encryption */
+const KEY_LENGTH = 32;
+/** A keystore project key that is not `<namespace>/<project>`. */
+var KeystoreProjectInvalid = class extends Error {
+	key;
+	constructor(key) {
+		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
+		this.key = key;
+		this.name = "KeystoreProjectInvalid";
 	}
-	if (provider === "hostinger") {
-		logger$2.log("\n🔐 Logging in to Hostinger...\n");
-		let token = providedToken;
-		if (!token) {
-			logger$2.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
-			token = await prompt("API Token: ", {
-				hidden: true,
-				instead: LOGIN_INSTEAD
-			});
-		}
-		if (!token) {
-			logger$2.error("Token is required");
-			process.exit(1);
-		}
-		await storeHostingerToken(token);
-		logger$2.log("\n✓ Hostinger token stored.");
-		logger$2.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger$2.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
-		logger$2.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
+};
+/** A stage has no key, here or at the place keys used to be kept. */
+var KeyNotFound = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Encryption key not found for stage "${stage}" in project "${project}". Expected key at: ${path}. Run \`gkm secrets:init --stage ${stage}\` to create one, or copy the stage's key there.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "KeyNotFound";
 	}
+};
+const PROJECT_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* The keystore key of a workspace: its deploy identity without the stage, so
+* a project's keys and its Dokploy project are named by the same thing.
+*/
+function projectKey(workspace) {
+	return deployIdentity(workspace, "").key;
+}
+/** The keystore project of a loaded workspace. */
+function keystoreProject(workspace, home) {
+	const key = projectKey(workspace);
+	const unscoped = projectKey({ name: workspace.name });
+	return {
+		key,
+		legacy: [.../* @__PURE__ */ new Set([folderName(workspace.root), workspace.name])].filter((name) => !!name),
+		...unscoped !== key ? { aliases: [unscoped] } : {},
+		...home ? { home } : {}
+	};
 }
 /**
-* Logout from a service
+* Whether `name` stays inside the home it is joined to. A workspace name was
+* joined as is — `@acme/shop` is `~/.gkm/@acme/shop` — but never upwards.
 */
-async function logoutCommand(options) {
-	const { provider = "dokploy" } = options;
-	if (provider === "all") {
-		if (await removeDokployCredentials()) logger$2.log("\n✓ Logged out from all services");
-		else logger$2.log("\nNo stored credentials found");
-		return;
+function isLegacyName(name) {
+	return name.split(/[\\/]/).every((part) => part !== ".." && part !== "");
+}
+/** The last segment of a path, as the old keystore named projects. */
+function folderName(path) {
+	const name = path.split(/[\\/]/).filter(Boolean).at(-1);
+	return name && name !== "." && name !== ".." ? name : void 0;
+}
+/**
+* Get the keystore directory for a project:
+* `<home>/keys/<namespace>/<project>`.
+*/
+function getKeystoreDir(project) {
+	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
+	const [namespace, name] = project.key.split("/");
+	return join(project.home ?? gkmHome(), "keys", namespace, name);
+}
+/** Get the path to a stage's encryption key. */
+function getKeyPath(stage, project) {
+	return join(getKeystoreDir(project), `${stage}.key`);
+}
+/**
+* Where else a stage's key may be, most likely first: under an alias of the
+* project, then where keys were kept before they were keyed by identity —
+* under the configured home, then under `~/.gkm`, which is where every CLI
+* before `GKM_HOME` wrote.
+*/
+function legacyKeyPaths(stage, project) {
+	const aliases = (project.aliases ?? []).map((key) => getKeyPath(stage, {
+		key,
+		home: project.home
+	}));
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? gkmHome(), join(homedir(), ".gkm")])];
+	const names = (project.legacy ?? []).filter(isLegacyName);
+	return [...aliases, ...names.flatMap((name) => homes.map((home) => join(home, name, `${stage}.key`)))];
+}
+/**
+* Generate a new encryption key for a stage, stored owner-only at
+* `<home>/keys/<namespace>/<project>/<stage>.key`.
+*/
+async function generateKey(stage, project, flag = "w") {
+	const keyDir = getKeystoreDir(project);
+	const keyPath = getKeyPath(stage, project);
+	await mkdir(keyDir, {
+		recursive: true,
+		mode: 448
+	});
+	const key = randomBytes(KEY_LENGTH).toString("hex");
+	await writeFile(keyPath, key, {
+		mode: 384,
+		encoding: "utf-8",
+		flag
+	});
+	await chmod(keyPath, 384);
+	return key;
+}
+/**
+* Copy a key from where it used to be kept to where it is kept now.
+*
+* Copied, not moved: an older CLI on the same machine still reads the old
+* place. Exclusive, so two processes migrating at once cannot overwrite a key
+* one of them already put there.
+*/
+async function migrateLegacyKey(stage, project) {
+	const legacy = legacyKeyPaths(stage, project).find((path) => existsSync(path));
+	if (!legacy) return false;
+	const keyPath = getKeyPath(stage, project);
+	await mkdir(getKeystoreDir(project), {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		await copyFile(legacy, keyPath, constants.COPYFILE_EXCL);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
 	}
-	if (provider === "dokploy") {
-		if (await removeDokployCredentials()) logger$2.log("\n✓ Logged out from Dokploy");
-		else logger$2.log("\nNo Dokploy credentials found");
+	await chmod(keyPath, 384);
+	return true;
+}
+/**
+* Read an encryption key for a stage, or `null` when there is none — after
+* copying it over from where keys used to be kept, if it is still there.
+*/
+async function readKey(stage, project) {
+	const keyPath = getKeyPath(stage, project);
+	if (!existsSync(keyPath) && !await migrateLegacyKey(stage, project)) return null;
+	return (await readFile(keyPath, "utf-8")).trim();
+}
+/**
+* Read an encryption key for a stage, throwing {@link KeyNotFound} if there
+* is none.
+*/
+async function requireKey(stage, project) {
+	const key = await readKey(stage, project);
+	if (!key) throw new KeyNotFound(stage, project.key, getKeyPath(stage, project));
+	return key;
+}
+/**
+* Get or create a key for a stage.
+* If the key already exists, it is returned. Otherwise, a new key is generated.
+*/
+async function getOrCreateKey(stage, project) {
+	const existingKey = await readKey(stage, project);
+	if (existingKey) return existingKey;
+	try {
+		return await generateKey(stage, project, "wx");
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		return requireKey(stage, project);
 	}
 }
+//#endregion
+//#region src/secrets/file.ts
+/** Where the files live, relative to the project root. */
+const SECRETS_DIR = ".gkm/secrets";
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
 /**
-* Show current login status
+* A stage's secrets as an encrypted file on this machine:
+* `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
+* `keys/<namespace>/<project>/<stage>.key`.
+*
+* The local stage's store, always — its secrets belong to the machine running
+* `gkm dev` — and a deployed stage's when `secrets.store` is `'file'`.
 */
-async function whoamiCommand() {
-	logger$2.log("\n📋 Current credentials:\n");
-	const dokploy = await getDokployCredentials();
-	if (dokploy) {
-		logger$2.log("  Dokploy:");
-		logger$2.log(`    Endpoint: ${dokploy.endpoint}`);
-		logger$2.log(`    Token: ${maskToken(dokploy.token)}`);
-	} else logger$2.log("  Dokploy: Not logged in");
-	logger$2.log(`\n  Credentials file: ${getCredentialsPath()}`);
+var FileSecretsStore = class {
+	root;
+	name = "file";
+	project;
+	/**
+	* @param project - Whose keys: a workspace's `keystoreProject()`. Outside a
+	*   workspace there is no config to name the project, so it is named the
+	*   way a workspace without `name` is — its package name, else its folder.
+	*/
+	constructor(root, project) {
+		this.root = root;
+		this.project = project ?? {
+			key: projectKey({ name: packageName(root) ?? basename(root) }),
+			legacy: [basename(root)]
+		};
+	}
+	/** The file a stage's secrets are kept in. */
+	path(stage) {
+		return join(this.root, SECRETS_DIR, `${stage}.json`);
+	}
+	async read(stage) {
+		const path = this.path(stage);
+		if (!existsSync(path)) return null;
+		const data = JSON.parse(await readFile(path, "utf-8"));
+		if (!(data.version === 1 && data.encrypted && data.iv)) return data;
+		const key = await readKey(stage, this.project);
+		if (!key) throw new MissingSecretsKey(stage, this.project.key, getKeyPath(stage, this.project));
+		return decrypt(data, key);
+	}
+	async write(stage, secrets) {
+		await mkdir(join(this.root, SECRETS_DIR), { recursive: true });
+		const key = await getOrCreateKey(stage, this.project);
+		await writeFile(this.path(stage), JSON.stringify(encrypt(secrets, key), null, 2), "utf-8");
+	}
+};
+/** A stage's secrets file exists, and the key that opens it does not. */
+var MissingSecretsKey = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Decryption key not found for stage "${stage}". Expected key at: ${path}. Copy the stage's key there from whoever created it, or set secrets.store to a store this machine can reach.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "MissingSecretsKey";
+	}
+};
+/** A project's package name without its scope, as a workspace name reads it. */
+function packageName(root) {
+	try {
+		const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
+		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
+	} catch {
+		return;
+	}
+}
+function encrypt(secrets, keyHex) {
+	const key = Buffer.from(keyHex, "hex");
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv(ALGORITHM, key, iv);
+	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
+	return {
+		version: 1,
+		encrypted: Buffer.concat([ciphertext, cipher.getAuthTag()]).toString("base64"),
+		iv: iv.toString("hex")
+	};
+}
+function decrypt(data, keyHex) {
+	const key = Buffer.from(keyHex, "hex");
+	const combined = Buffer.from(data.encrypted, "base64");
+	const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(data.iv, "hex"));
+	decipher.setAuthTag(combined.subarray(-16));
+	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
+	return JSON.parse(plaintext.toString("utf-8"));
 }
+//#endregion
+//#region src/secrets/store.ts
+var store_exports = /* @__PURE__ */ __exportAll({
+	FileSecretsStore: () => FileSecretsStore,
+	isRemoteStore: () => isRemoteStore,
+	secretsStoreFor: () => secretsStoreFor
+});
 /**
-* Mask a token for display
+* The store a stage's secrets are kept in — what every command reads and
+* writes, for the stage it acts on.
+*
+* The local stage is always the file: its secrets belong to the machine
+* running `gkm dev`. A deployed stage uses `secrets.store`.
 */
-function maskToken(token) {
-	if (token.length <= 8) return "****";
-	return `${token.slice(0, 4)}...${token.slice(-4)}`;
+async function secretsStoreFor(workspace, stage, options = {}) {
+	const configured = workspace.secrets.store ?? "file";
+	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	if (configured.provider !== "ssm") return configured.provider;
+	const { AwsSecretsStore } = await import("./aws-DojzQnLd.mjs");
+	return new AwsSecretsStore({
+		project: workspace.name,
+		region: configured.region,
+		...options.profile ? { profile: options.profile } : {}
+	});
+}
+/** Whether a stage's secrets live somewhere other than this machine. */
+function isRemoteStore(workspace, stage) {
+	const configured = workspace.secrets.store ?? "file";
+	return stage !== workspace.stages.local && configured !== "file";
 }
 //#endregion
 //#region src/credentials/index.ts
@@ -453,17 +786,6 @@ async function prepareEntryCredentials(options) {
 	};
 }
 //#endregion
-//#region src/workspace/client-generator.ts
-/**
-* Normalize routes to an array of patterns.
-* Handles a glob or a list of them.
-* @internal Exported for use in dev command
-*/
-function normalizeRoutes(routes) {
-	if (!routes) return [];
-	return Array.isArray(routes) ? routes : [routes];
-}
-//#endregion
 //#region src/reconcile/containers.ts
 /**
 * What gkm knows about each container it can derive.
@@ -3358,822 +3680,693 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ __exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
+//#region src/target/dokploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
 /**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
+* The hostname an app answers on for a stage.
+*
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
 *
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
 */
-function encryptSecrets(secrets) {
-	const masterKey = randomBytes(KEY_LENGTH);
-	const iv = randomBytes(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = createCipheriv(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
+	if (app.domain) {
+		if (typeof app.domain === "string") return app.domain;
+		if (app.domain[stage]) return app.domain[stage];
+	}
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
+	if (isMainFrontend) return baseDomain;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
 /**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
+* Whether this app is the site the base domain points at — see `rootSite`,
+* which the local edge asks too.
+*
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
 */
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
+function isMainFrontendApp(appName, app, allApps) {
+	if (app.type !== "web") return false;
+	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
+		name,
+		root: a.root
+	}))) === appName;
 }
 /**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
+* Get public URL arg names from app dependencies.
 *
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
+* @param app - The web/mobile app configuration
+* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
+*   without a public prefix (e.g. Remix).
 */
-function keyFingerprint(masterKey) {
-	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
+function getPublicUrlArgNames(app) {
+	const prefix = getPublicEnvPrefix(app.framework);
+	if (!prefix) return [];
+	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
 }
 //#endregion
-//#region src/deploy/generated.ts
+//#region src/docker/imageRef.ts
 /**
-* The values a deployed stage generates once and keeps: what nothing can
-* provision and nobody else issues.
-*
-* - **A seed**, which salts every password a deploy derives — a database's
-*   master and roles, a bucket's root user. Derived from repo facts alone
-*   (project, stage, construct id), those passwords were computable by anyone
-*   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
-* - **Each `encryption` construct's keyring** — one random key and an index
-*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
+* An image reference, checked before it reaches `docker`.
 *
-* Both are generated on the first deploy that needs them and written to the
-* stage's store, so every later deploy reads the same values: sessions survive
-* a redeploy, and a role's password does not move. A value set by hand with
-* `gkm secrets:set` is kept, never replaced.
-*/
-/**
-* The stage's secrets with its seed and every declared `secret`'s value
-* present, generating what is missing. Pure: the caller writes the result
-* back to the stage's store when `generated` is not empty.
+* The parts come from the workspace — a registry in `gkm.config.ts`, an image
+* name from the project, a tag from `--tag` — and an argument array already
+* keeps them out of a shell. What it cannot do is stop `docker` reading a value
+* that starts with `-` as one of its own flags, so a ref is held to Docker's
+* own grammar (distribution/reference) and anything else is refused by name
+* before a build starts.
 */
-function withGeneratedSecrets(secrets, manifest) {
-	const generated = [];
-	const custom = { ...secrets.custom };
-	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
-		const key = declaration.provides?.[0];
-		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
-		generated.push(key);
+const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
+const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
+const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
+const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
+/** Docker refuses a repository name longer than this. */
+const MAX_NAME_LENGTH = 255;
+/** A value that is not an image reference was about to be built or pushed. */
+var ImageRefInvalid = class extends Error {
+	ref;
+	constructor(ref) {
+		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
+		this.ref = ref;
+		this.name = "ImageRefInvalid";
 	}
-	const seed = secrets.seed ?? random();
-	if (!secrets.seed) generated.push("seed");
-	return {
-		secrets: generated.length ? {
-			...secrets,
-			seed,
-			custom,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : secrets,
-		generated
-	};
-}
-/** 256 bits, URL-safe. */
-function random() {
-	return randomBytes(32).toString("base64url");
-}
-//#endregion
-//#region src/deploy/StateProvider.ts
-/**
-* Check if value is a StateProvider implementation.
-*/
-function isStateProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
+};
+/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
+function validateImageRef(ref) {
+	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
+	return ref;
 }
 //#endregion
-//#region src/deploy/StateStore.ts
+//#region src/docker/templates.ts
+const LOCKFILES = [
+	["pnpm-lock.yaml", "pnpm"],
+	["bun.lockb", "bun"],
+	["yarn.lock", "yarn"],
+	["package-lock.json", "npm"]
+];
 /**
-* Deploy state store.
-*
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
-*
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
+* Detect package manager from lockfiles
+* Walks up the directory tree to find lockfile (for monorepos)
 */
-var StateLocked = class extends Error {
-	stage;
-	holder;
-	location;
-	constructor(stage, holder, location) {
-		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
-		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
-		this.stage = stage;
-		this.holder = holder;
-		this.location = location;
-		this.name = "StateLocked";
-	}
-};
-var StateVersionConflict = class extends Error {
-	stage;
-	expectedVersion;
-	actualVersion;
-	constructor(stage, expectedVersion, actualVersion) {
-		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
-		this.stage = stage;
-		this.expectedVersion = expectedVersion;
-		this.actualVersion = actualVersion;
-		this.name = "StateVersionConflict";
-	}
-};
-var StageStateMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
-		this.stage = stage;
-		this.name = "StageStateMissing";
-	}
-};
-var StateUnreadable = class extends Error {
-	stage;
-	location;
-	constructor(stage, location, cause) {
-		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateUnreadable";
-	}
-};
-var StateSchemaTooNew = class extends Error {
-	stage;
-	schemaVersion;
-	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
-		this.stage = stage;
-		this.schemaVersion = schemaVersion;
-		this.name = "StateSchemaTooNew";
+function detectPackageManager(cwd = process.cwd()) {
+	let dir = cwd;
+	const root = parse(dir).root;
+	while (dir !== root) {
+		for (const [lockfile, pm] of LOCKFILES) if (existsSync(join(dir, lockfile))) return pm;
+		dir = dirname(dir);
 	}
-};
+	for (const [lockfile, pm] of LOCKFILES) if (existsSync(join(root, lockfile))) return pm;
+	return "pnpm";
+}
 /**
-* Not thrown: emitted (once per store) when a custom `StateProvider` stands
-* in for a store, so a deploy that cannot be protected from a concurrent one
-* says so.
+* Find the lockfile path by walking up the directory tree
+* Returns the full path to the lockfile, or null if not found
 */
-var StateStoreWithoutLocking = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
-		this.provider = provider;
-		this.name = "StateStoreWithoutLocking";
-	}
-};
-var StateStoreNeedsWorkspaceName = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
-		this.provider = provider;
-		this.name = "StateStoreNeedsWorkspaceName";
-	}
-};
-var UnknownStateProvider = class extends Error {
-	config;
-	constructor(config) {
-		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
-		this.config = config;
-		this.name = "UnknownStateProvider";
-	}
-};
-/** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
-	stage;
-	location;
-	constructor(stage, location) {
-		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateStoreBusy";
+function findLockfilePath(cwd = process.cwd()) {
+	let dir = cwd;
+	const root = parse(dir).root;
+	while (dir !== root) {
+		for (const [lockfile] of LOCKFILES) {
+			const lockfilePath = join(dir, lockfile);
+			if (existsSync(lockfilePath)) return lockfilePath;
+		}
+		dir = dirname(dir);
 	}
-};
-function decodeDocument(stage, body, location) {
-	let parsed;
-	try {
-		parsed = JSON.parse(body);
-	} catch (error) {
-		throw new StateUnreadable(stage, location, error);
+	for (const [lockfile] of LOCKFILES) {
+		const lockfilePath = join(root, lockfile);
+		if (existsSync(lockfilePath)) return lockfilePath;
 	}
-	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
-	const schemaVersion = parsed.schemaVersion;
-	if (schemaVersion === void 0) return {
-		schemaVersion: 1,
-		state: parsed
-	};
-	if (schemaVersion === 2) return {
-		schemaVersion: 2,
-		document: parsed
-	};
-	throw new StateSchemaTooNew(stage, schemaVersion);
-}
-function encodeDocument(document) {
-	return JSON.stringify(document, null, 2);
+	return null;
 }
 /**
-* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
-* so the first journaled deploy after an upgrade adopts them rather than
-* treating them as unknown.
+* Check if we're in a monorepo (lockfile is in a parent directory)
 */
-function migrateV1(stage, state) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const resources = {};
-	const seed = (type, name, id) => {
-		if (!id) return;
-		const key = name ? `${type}:${name}` : type;
-		resources[key] = {
-			key,
-			type,
-			id,
-			status: "ready",
-			updatedAt: now
-		};
-	};
-	seed("project", null, state.projectId);
-	seed("environment", null, state.environmentId);
-	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
-	seed("postgres", null, state.services?.postgresId);
-	seed("redis", null, state.services?.redisId);
-	seed("backup-destination", null, state.backups?.destinationId);
-	return {
-		schemaVersion: 2,
-		stage,
-		serial: 1,
-		state,
-		resources,
-		updatedAt: now
-	};
-}
-function newLockHolder(options) {
-	let owner = "unknown";
-	try {
-		owner = userInfo().username;
-	} catch {}
-	return {
-		id: randomUUID(),
-		owner,
-		host: hostname(),
-		pid: process.pid,
-		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
-		operation: options?.operation
-	};
-}
-function contentVersion(body) {
-	return createHash("sha256").update(body).digest("hex").slice(0, 16);
+function isMonorepo(cwd = process.cwd()) {
+	const lockfilePath = findLockfilePath(cwd);
+	if (!lockfilePath) return false;
+	return dirname(lockfilePath) !== cwd;
 }
 /**
-* A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
+* Check if turbo.json exists (walks up directory tree)
 */
-var DocumentStateStore = class {
-	async lock(stage, options) {
-		const holder = newLockHolder(options);
-		await this.createLock(stage, holder);
-		let released = false;
-		return {
-			stage,
-			holder,
-			release: async () => {
-				if (released) return;
-				released = true;
-				await this.removeLock(stage, holder);
-			}
-		};
-	}
-	async forceUnlock(stage) {
-		const holder = await this.readLock(stage);
-		await this.removeLock(stage, null);
-		return holder;
-	}
-	async read(stage) {
-		const current = await this.readDocument(stage);
-		if (!current) return null;
-		return {
-			state: current.document.state,
-			resources: current.document.resources,
-			version: current.version
-		};
-	}
-	async write(stage, state, options) {
-		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
-				stage,
-				serial: 1,
-				state,
-				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
-			return this.writeRaw(stage, encodeDocument(document), null);
-		}
-		return this.mutate(stage, options.expectedVersion, (document) => ({
-			...document,
-			state
-		}));
-	}
-	async putResource(stage, record, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => ({
-			...document,
-			resources: {
-				...document.resources,
-				[record.key]: {
-					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-				}
-			}
-		}));
-	}
-	async deleteResource(stage, key, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => {
-			const { [key]: _removed, ...resources } = document.resources;
-			return {
-				...document,
-				resources
-			};
-		});
-	}
-	async mutate(stage, expectedVersion, change) {
-		const current = await this.readDocument(stage);
-		if (!current) {
-			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
-			throw new StageStateMissing(stage);
-		}
-		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
-		const next = change(current.document);
-		next.serial = current.document.serial + 1;
-		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
-	}
-	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
-	*/
-	async readDocument(stage, attempt = 0) {
-		const raw = await this.readRaw(stage);
-		if (!raw) return null;
-		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
-			document: decoded.document,
-			version: raw.version
-		};
-		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
-		try {
-			return {
-				document,
-				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
-			};
-		} catch (error) {
-			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
-			throw error;
-		}
+function hasTurboConfig(cwd = process.cwd()) {
+	let dir = cwd;
+	const root = parse(dir).root;
+	while (dir !== root) {
+		if (existsSync(join(dir, "turbo.json"))) return true;
+		dir = dirname(dir);
 	}
-};
-function isStateStore(value) {
-	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
+	return existsSync(join(root, "turbo.json"));
 }
 /**
-* The store for a workspace's `state` config:
-*
-* - none / `'local'`: `LocalStateStore` under `.gkm/`
-* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
-*   a stale local copy can never win over it
-* - `'s3'`: `S3StateStore`
-* - a `StateStore` object: used as is
-* - a `StateProvider` object: wrapped by `LegacyStateStore`
+* Get install command for turbo builds (without frozen lockfile)
+* Turbo prune creates a subset that may not perfectly match the lockfile
 */
-async function createStateStore(options) {
-	const { config, workspaceRoot, workspaceName } = options;
-	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-Cy1ZBW7U.mjs").then((n) => n.n);
-		return new LocalStateStore(workspaceRoot);
-	}
-	if (isStateStore(config.provider)) return config.provider;
-	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-DIgkGaUP.mjs");
-		return new LegacyStateStore(config.provider, { warn: options.warn });
-	}
-	if (config.provider === "ssm") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-DfF174xQ.mjs");
-		const ssm = config;
-		return SSMStateStore.create({
-			workspaceName,
-			region: ssm.region,
-			profile: ssm.profile
-		});
-	}
-	if (config.provider === "s3") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-D3x6ivBL.mjs");
-		const s3 = config;
-		return S3StateStore.create({
-			workspaceName,
-			bucket: s3.bucket,
-			prefix: s3.prefix,
-			region: s3.region,
-			profile: s3.profile
-		});
-	}
-	throw new UnknownStateProvider(config);
+function getTurboInstallCmd(pm) {
+	return {
+		pnpm: "pnpm install",
+		npm: "npm install",
+		yarn: "yarn install",
+		bun: "bun install"
+	}[pm];
 }
-//#endregion
-//#region src/deploy/state.ts
 /**
-* Create a new empty state for a stage
+* Get package manager specific commands and paths
 */
-function createEmptyState(stage, projectId, environmentId) {
+function getPmConfig(pm) {
 	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
+		pnpm: {
+			install: "corepack enable && corepack prepare pnpm@latest --activate",
+			lockfile: "pnpm-lock.yaml",
+			fetch: "pnpm fetch",
+			installCmd: "pnpm install --frozen-lockfile --offline",
+			cacheTarget: "/root/.local/share/pnpm/store",
+			cacheId: "pnpm",
+			run: "pnpm",
+			exec: "pnpm exec",
+			dlx: "pnpm dlx",
+			addGlobal: "pnpm add -g"
+		},
+		npm: {
+			install: "",
+			lockfile: "package-lock.json",
+			fetch: "",
+			installCmd: "npm ci",
+			cacheTarget: "/root/.npm",
+			cacheId: "npm",
+			run: "npm run",
+			exec: "npx",
+			dlx: "npx",
+			addGlobal: "npm install -g"
+		},
+		yarn: {
+			install: "corepack enable && corepack prepare yarn@stable --activate",
+			lockfile: "yarn.lock",
+			fetch: "",
+			installCmd: "yarn install --frozen-lockfile",
+			cacheTarget: "/root/.yarn/cache",
+			cacheId: "yarn",
+			run: "yarn",
+			exec: "yarn exec",
+			dlx: "yarn dlx",
+			addGlobal: "yarn global add"
+		},
+		bun: {
+			install: "npm install -g bun",
+			lockfile: "bun.lockb",
+			fetch: "",
+			installCmd: "bun install --frozen-lockfile",
+			cacheTarget: "/root/.bun/install/cache",
+			cacheId: "bun",
+			run: "bun run",
+			exec: "bunx",
+			dlx: "bunx",
+			addGlobal: "bun add -g"
+		}
+	}[pm];
 }
 /**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/**
-* Record the image an app was deployed with (mutates state)
-*/
-function setDeployedImage(state, appName, image) {
-	state.images = {
-		...state.images,
-		[appName]: image
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
+* Generate a multi-stage Dockerfile for building from source
+* Optimized for build speed with:
+* - BuildKit cache mounts for package manager store
+* - pnpm fetch for better layer caching (when using pnpm)
+* - Optional turbo prune for monorepos
 */
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
+function generateMultiStageDockerfile(options) {
+	const { baseImage, port, healthCheckPath, turbo, turboPackage, packageManager } = options;
+	if (turbo) return generateTurboDockerfile({
+		...options,
+		turboPackage: turboPackage ?? "api"
+	});
+	const pm = getPmConfig(packageManager);
+	return `# syntax=docker/dockerfile:1
+# Stage 1: Dependencies
+FROM ${baseImage} AS deps
+
+WORKDIR /app
+${pm.install ? `\n# Install ${packageManager}\nRUN ${pm.install}\n` : ""}
+${packageManager === "pnpm" ? `# Copy lockfile first for better caching
+COPY ${pm.lockfile} ./
+
+# Fetch dependencies (downloads to virtual store, cached separately)
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.fetch}
+
+# Copy package.json after fetch
+COPY package.json ./
+
+# Install from cache (fast - no network needed)
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}` : `# Copy package files
+COPY package.json ${pm.lockfile} ./
+
+# Install dependencies with cache
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}`}
+
+# Stage 2: Build
+FROM deps AS builder
+
+WORKDIR /app
+
+# Copy source (deps already installed)
+COPY . .
+
+# Build any workspace packages the app depends on.
+#
+# A no-op for a project whose dependencies come from a registry, and required
+# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
+# workspace package's \`dist\` never reaches the image and its bin has nothing to
+# import. \`--if-present\` is what makes the same Dockerfile correct for both.
+RUN ${pm.run} --if-present build
+
+# Build production server using gkm
+RUN ${pm.exec} gkm build --provider server --production
+
+# Stage 3: Production
+FROM ${baseImage} AS runner
+
+WORKDIR /app
+
+# Install tini for proper signal handling as PID 1
+RUN apk add --no-cache tini
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+# Copy bundled server
+COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
+
+# Environment
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+# Switch to non-root user
+USER hono
+
+EXPOSE ${port}
+
+# Use tini as entrypoint to handle PID 1 responsibilities
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
 }
 /**
-* Set a created DNS record in state (mutates state)
+* Generate a Dockerfile optimized for Turbo monorepos
+* Uses turbo prune to create minimal Docker context
 */
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
+function generateTurboDockerfile(options) {
+	const { baseImage, port, healthCheckPath, turboPackage, packageManager } = options;
+	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `RUN ${pm.install}` : "";
+	const turboInstallCmd = getTurboInstallCmd(packageManager);
+	return `# syntax=docker/dockerfile:1
+# Stage 1: Prune monorepo
+FROM ${baseImage} AS pruner
+
+WORKDIR /app
+
+${installPm}
+
+COPY . .
+
+# Prune to only include necessary packages
+RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
+
+# Stage 2: Install dependencies
+FROM ${baseImage} AS deps
+
+WORKDIR /app
+
+${installPm}
+
+# Copy pruned lockfile and package.jsons
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+
+# Install dependencies (no frozen-lockfile since turbo prune creates a subset)
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${turboInstallCmd}
+
+# Stage 3: Build
+FROM deps AS builder
+
+WORKDIR /app
+
+# Copy pruned source
+COPY --from=pruner /app/out/full/ ./
+
+# Build any workspace packages the app depends on.
+#
+# A no-op for a project whose dependencies come from a registry, and required
+# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
+# workspace package's \`dist\` never reaches the image and its bin has nothing to
+# import. \`--if-present\` is what makes the same Dockerfile correct for both.
+RUN ${pm.run} --if-present build
+
+# Build production server using gkm
+RUN ${pm.exec} gkm build --provider server --production
+
+# Stage 4: Production
+FROM ${baseImage} AS runner
+
+WORKDIR /app
+
+RUN apk add --no-cache tini
+
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+USER hono
+
+EXPOSE ${port}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
 }
 /**
-* Get backup state from state
+* Generate a slim Dockerfile for pre-built bundles
 */
-function getBackupState(state) {
-	return state?.backups;
+function generateSlimDockerfile(options) {
+	const { baseImage, port, healthCheckPath, bundle = ".gkm/server/dist/server.mjs" } = options;
+	return `# Slim Dockerfile for pre-built production bundle
+FROM ${baseImage}
+
+WORKDIR /app
+
+# Install tini for proper signal handling as PID 1
+# Handles SIGTERM propagation and zombie process reaping
+RUN apk add --no-cache tini
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+# Copy pre-built bundle
+COPY ${bundle} ./
+
+# Environment
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+# Switch to non-root user
+USER hono
+
+EXPOSE ${port}
+
+# Use tini as entrypoint to handle PID 1 responsibilities
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
 }
 /**
-* Set backup state (mutates state)
+* Generate .dockerignore file
 */
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
+function generateDockerignore() {
+	return `# Dependencies
+node_modules
+.pnpm-store
+
+# Build output (except what we need)
+.gkm/aws*
+.gkm/server/*.ts
+!.gkm/server/dist
+
+# The key gkm build --stage encrypted secrets with: runtime env only, never
+# the build context
+.gkm/server/master.key
+
+# gkm compose's stacks: each app's env file holds its stage's secrets
+.gkm/compose
+
+# IDE and editor
+.idea
+.vscode
+*.swp
+*.swo
+
+# Git
+.git
+.gitignore
+
+# Logs
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Test files
+**/*.test.ts
+**/*.spec.ts
+**/__tests__
+coverage
+
+# Documentation
+docs
+*.md
+!README.md
+
+# Environment files (handle secrets separately)
+.env
+.env.*
+!.env.example
+
+# Docker files (don't copy recursively)
+Dockerfile*
+docker-compose*
+.dockerignore
+`;
 }
-//#endregion
-//#region src/deploy/domain.ts
-/** A stage was deployed that `deploy.domains` gives no domain. */
-var NoDomainForStage = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
-		this.stage = stage;
-		this.name = "NoDomainForStage";
-	}
-};
 /**
-* The hostname an app answers on for a stage.
-*
-* 1. An explicit `app.domain` — a string, or one per stage — wins.
-* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
-*    answers on the domain itself, and every other app on
-*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
-*
-* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
+* Generate docker-entrypoint.sh for custom startup logic
 */
-function resolveHost(appName, app, stage, domains, isMainFrontend) {
-	if (app.domain) {
-		if (typeof app.domain === "string") return app.domain;
-		if (app.domain[stage]) return app.domain[stage];
-	}
-	const baseDomain = domains?.[stage];
-	if (!baseDomain) throw new NoDomainForStage(stage);
-	if (isMainFrontend) return baseDomain;
-	return `${app.subdomain ?? appName}.${baseDomain}`;
+function generateDockerEntrypoint() {
+	return `#!/bin/sh
+set -e
+
+# Run any custom startup scripts here
+# Example: wait for database
+# until nc -z $DB_HOST $DB_PORT; do
+#   echo "Waiting for database..."
+#   sleep 1
+# done
+
+# Execute the main command
+exec "$@"
+`;
 }
 /**
-* Whether this app is the site the base domain points at — see `rootSite`,
-* which the local edge asks too.
-*
-* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
+* Resolve Docker configuration from GkmConfig with defaults
 */
-function isMainFrontendApp(appName, app, allApps) {
-	if (app.type !== "web") return false;
-	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
-		name,
-		root: a.root
-	}))) === appName;
+function resolveDockerConfig(config) {
+	const docker = config.docker ?? {};
+	return {
+		registry: docker.registry ?? "",
+		imageName: docker.imageName ?? config.name ?? "api",
+		baseImage: docker.baseImage ?? "node:22-alpine",
+		port: docker.port ?? 3e3
+	};
 }
 /**
-* Get public URL arg names from app dependencies.
-*
-* @param app - The web/mobile app configuration
-* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
-*   without a public prefix (e.g. Remix).
+* Generate a Dockerfile for Next.js frontend apps using standalone output.
+* Uses turbo prune for monorepo optimization.
+* @internal Exported for testing
 */
-function getPublicUrlArgNames(app) {
-	const prefix = getPublicEnvPrefix(app.framework);
-	if (!prefix) return [];
-	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
+function generateNextjsDockerfile(options) {
+	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
+	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `RUN ${pm.install}` : "";
+	const turboInstallCmd = getTurboInstallCmd(packageManager);
+	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
+	const publicUrlArgDeclarations = publicUrlArgs.map((arg) => `ARG ${arg}=""`).join("\n");
+	const publicUrlEnvDeclarations = publicUrlArgs.map((arg) => `ENV ${arg}=$${arg}`).join("\n");
+	return `# syntax=docker/dockerfile:1
+# Next.js standalone Dockerfile with turbo prune optimization
+
+# Stage 1: Prune monorepo
+FROM ${baseImage} AS pruner
+
+WORKDIR /app
+
+${installPm}
+
+COPY . .
+
+# Prune to only include necessary packages
+RUN ${turboCmd} prune ${turboPackage} --docker
+
+# Stage 2: Install dependencies
+FROM ${baseImage} AS deps
+
+WORKDIR /app
+
+${installPm}
+
+# Copy pruned lockfile and package.jsons
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+
+# Install dependencies
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${turboInstallCmd}
+
+# Stage 3: Build
+FROM deps AS builder
+
+WORKDIR /app
+
+# Build-time args for public API URLs (populated by gkm deploy)
+# These get baked into the Next.js build as public environment variables
+${publicUrlArgDeclarations}
+
+# Convert ARGs to ENVs for Next.js build
+${publicUrlEnvDeclarations}
+
+# Copy pruned source
+COPY --from=pruner /app/out/full/ ./
+
+# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
+# Using wildcard to make it optional for single-app projects
+COPY --from=pruner /app/tsconfig.* ./
+
+# Ensure public directory exists (may be empty for scaffolded projects)
+RUN mkdir -p ${appPath}/public
+
+# Set Next.js to produce standalone output
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Build the application
+RUN ${turboCmd} run build --filter=${turboPackage}
+
+# Stage 4: Production
+FROM ${baseImage} AS runner
+
+WORKDIR /app
+
+# Install tini for proper signal handling
+RUN apk add --no-cache tini
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 nextjs
+
+# Set environment
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=${port}
+ENV HOSTNAME="0.0.0.0"
+
+# Copy static files and standalone output
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/static ./${appPath}/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/public ./${appPath}/public
+
+USER nextjs
+
+EXPOSE ${port}
+
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "${appPath}/server.js"]
+`;
 }
-//#endregion
-//#region src/docker/imageRef.ts
 /**
-* An image reference, checked before it reaches `docker`.
-*
-* The parts come from the workspace — a registry in `gkm.config.ts`, an image
-* name from the project, a tag from `--tag` — and an argument array already
-* keeps them out of a shell. What it cannot do is stop `docker` reading a value
-* that starts with `-` as one of its own flags, so a ref is held to Docker's
-* own grammar (distribution/reference) and anything else is refused by name
-* before a build starts.
+* Generate a Dockerfile for backend apps in a workspace.
+* Uses turbo prune for monorepo optimization.
+* @internal Exported for testing
 */
-const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
-const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
-const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
-const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
-/** Docker refuses a repository name longer than this. */
-const MAX_NAME_LENGTH = 255;
-/** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends Error {
-	ref;
-	constructor(ref) {
-		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
-		this.ref = ref;
-		this.name = "ImageRefInvalid";
-	}
-};
-/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
-function validateImageRef(ref) {
-	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
-	return ref;
-}
-//#endregion
-//#region src/docker/templates.ts
-const LOCKFILES = [
-	["pnpm-lock.yaml", "pnpm"],
-	["bun.lockb", "bun"],
-	["yarn.lock", "yarn"],
-	["package-lock.json", "npm"]
-];
-/**
-* Detect package manager from lockfiles
-* Walks up the directory tree to find lockfile (for monorepos)
-*/
-function detectPackageManager(cwd = process.cwd()) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	while (dir !== root) {
-		for (const [lockfile, pm] of LOCKFILES) if (existsSync(join(dir, lockfile))) return pm;
-		dir = dirname(dir);
-	}
-	for (const [lockfile, pm] of LOCKFILES) if (existsSync(join(root, lockfile))) return pm;
-	return "pnpm";
-}
-/**
-* Find the lockfile path by walking up the directory tree
-* Returns the full path to the lockfile, or null if not found
-*/
-function findLockfilePath(cwd = process.cwd()) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	while (dir !== root) {
-		for (const [lockfile] of LOCKFILES) {
-			const lockfilePath = join(dir, lockfile);
-			if (existsSync(lockfilePath)) return lockfilePath;
-		}
-		dir = dirname(dir);
-	}
-	for (const [lockfile] of LOCKFILES) {
-		const lockfilePath = join(root, lockfile);
-		if (existsSync(lockfilePath)) return lockfilePath;
-	}
-	return null;
-}
-/**
-* Check if we're in a monorepo (lockfile is in a parent directory)
-*/
-function isMonorepo(cwd = process.cwd()) {
-	const lockfilePath = findLockfilePath(cwd);
-	if (!lockfilePath) return false;
-	return dirname(lockfilePath) !== cwd;
-}
-/**
-* Check if turbo.json exists (walks up directory tree)
-*/
-function hasTurboConfig(cwd = process.cwd()) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	while (dir !== root) {
-		if (existsSync(join(dir, "turbo.json"))) return true;
-		dir = dirname(dir);
-	}
-	return existsSync(join(root, "turbo.json"));
-}
-/**
-* Get install command for turbo builds (without frozen lockfile)
-* Turbo prune creates a subset that may not perfectly match the lockfile
-*/
-function getTurboInstallCmd(pm) {
-	return {
-		pnpm: "pnpm install",
-		npm: "npm install",
-		yarn: "yarn install",
-		bun: "bun install"
-	}[pm];
-}
-/**
-* Get package manager specific commands and paths
-*/
-function getPmConfig(pm) {
-	return {
-		pnpm: {
-			install: "corepack enable && corepack prepare pnpm@latest --activate",
-			lockfile: "pnpm-lock.yaml",
-			fetch: "pnpm fetch",
-			installCmd: "pnpm install --frozen-lockfile --offline",
-			cacheTarget: "/root/.local/share/pnpm/store",
-			cacheId: "pnpm",
-			run: "pnpm",
-			exec: "pnpm exec",
-			dlx: "pnpm dlx",
-			addGlobal: "pnpm add -g"
-		},
-		npm: {
-			install: "",
-			lockfile: "package-lock.json",
-			fetch: "",
-			installCmd: "npm ci",
-			cacheTarget: "/root/.npm",
-			cacheId: "npm",
-			run: "npm run",
-			exec: "npx",
-			dlx: "npx",
-			addGlobal: "npm install -g"
-		},
-		yarn: {
-			install: "corepack enable && corepack prepare yarn@stable --activate",
-			lockfile: "yarn.lock",
-			fetch: "",
-			installCmd: "yarn install --frozen-lockfile",
-			cacheTarget: "/root/.yarn/cache",
-			cacheId: "yarn",
-			run: "yarn",
-			exec: "yarn exec",
-			dlx: "yarn dlx",
-			addGlobal: "yarn global add"
-		},
-		bun: {
-			install: "npm install -g bun",
-			lockfile: "bun.lockb",
-			fetch: "",
-			installCmd: "bun install --frozen-lockfile",
-			cacheTarget: "/root/.bun/install/cache",
-			cacheId: "bun",
-			run: "bun run",
-			exec: "bunx",
-			dlx: "bunx",
-			addGlobal: "bun add -g"
-		}
-	}[pm];
-}
-/**
-* Generate a multi-stage Dockerfile for building from source
-* Optimized for build speed with:
-* - BuildKit cache mounts for package manager store
-* - pnpm fetch for better layer caching (when using pnpm)
-* - Optional turbo prune for monorepos
-*/
-function generateMultiStageDockerfile(options) {
-	const { baseImage, port, healthCheckPath, turbo, turboPackage, packageManager } = options;
-	if (turbo) return generateTurboDockerfile({
-		...options,
-		turboPackage: turboPackage ?? "api"
-	});
+function generateBackendDockerfile(options) {
+	const { baseImage, port, appPath, turboPackage, packageManager, healthCheckPath = "/health" } = options;
 	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `RUN ${pm.install}` : "";
+	const turboInstallCmd = getTurboInstallCmd(packageManager);
 	return `# syntax=docker/dockerfile:1
-# Stage 1: Dependencies
-FROM ${baseImage} AS deps
+# Backend Dockerfile with turbo prune optimization
+
+# Stage 1: Prune monorepo
+FROM ${baseImage} AS pruner
 
 WORKDIR /app
-${pm.install ? `\n# Install ${packageManager}\nRUN ${pm.install}\n` : ""}
-${packageManager === "pnpm" ? `# Copy lockfile first for better caching
-COPY ${pm.lockfile} ./
 
-# Fetch dependencies (downloads to virtual store, cached separately)
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${pm.fetch}
+${installPm}
 
-# Copy package.json after fetch
-COPY package.json ./
+COPY . .
 
-# Install from cache (fast - no network needed)
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${pm.installCmd}` : `# Copy package files
-COPY package.json ${pm.lockfile} ./
+# Prune to only include necessary packages
+RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
 
-# Install dependencies with cache
+# Stage 2: Install dependencies
+FROM ${baseImage} AS deps
+
+WORKDIR /app
+
+${installPm}
+
+# Copy pruned lockfile and package.jsons
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+
+# Install dependencies
 RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${pm.installCmd}`}
+    ${turboInstallCmd}
 
-# Stage 2: Build
+# Stage 3: Build
 FROM deps AS builder
 
 WORKDIR /app
 
-# Copy source (deps already installed)
-COPY . .
+# Copy pruned source
+COPY --from=pruner /app/out/full/ ./
+
+# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
+# Using wildcard to make it optional for single-app projects
+COPY --from=pruner /app/gkm.config.* ./
+COPY --from=pruner /app/tsconfig.* ./
+
+# Write encrypted credentials for gkm build to embed.
+# A build secret (\`docker build --secret id=gkm_credentials,src=…\`), not an
+# ARG: an ARG is recorded in the image history. Two lines, ciphertext then IV;
+# absent when the app has no secrets.
+RUN --mount=type=secret,id=gkm_credentials,required=false \
+    if [ -s /run/secrets/gkm_credentials ]; then \
+      mkdir -p ${appPath}/.gkm && \
+      sed -n 1p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.enc && \
+      sed -n 2p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.iv; \
+    fi
 
 # Build any workspace packages the app depends on.
 #
@@ -4184,51 +4377,49 @@ COPY . .
 RUN ${pm.run} --if-present build
 
 # Build production server using gkm
-RUN ${pm.exec} gkm build --provider server --production
+RUN cd ${appPath} && ${pm.exec} gkm build --provider server --production
 
-# Stage 3: Production
+# Stage 4: Production
 FROM ${baseImage} AS runner
 
 WORKDIR /app
 
-# Install tini for proper signal handling as PID 1
 RUN apk add --no-cache tini
 
-# Create non-root user
 RUN addgroup --system --gid 1001 nodejs && \\
     adduser --system --uid 1001 hono
 
 # Copy bundled server
-COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
+COPY --from=builder --chown=hono:nodejs /app/${appPath}/.gkm/server/dist/server.mjs ./
 
-# Environment
 ENV NODE_ENV=production
 ENV PORT=${port}
 
-# Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
   CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
 
-# Switch to non-root user
 USER hono
 
 EXPOSE ${port}
 
-# Use tini as entrypoint to handle PID 1 responsibilities
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["node", "server.mjs"]
 `;
 }
 /**
-* Generate a Dockerfile optimized for Turbo monorepos
-* Uses turbo prune to create minimal Docker context
+* Generate a Dockerfile for apps with a custom entry point.
+* Uses esbuild to bundle the entry point into dist/index.mjs with all dependencies.
+* This is used for apps that don't use gkm routes (e.g., Better Auth servers).
+* @internal Exported for testing
 */
-function generateTurboDockerfile(options) {
-	const { baseImage, port, healthCheckPath, turboPackage, packageManager } = options;
+function generateEntryDockerfile(options) {
+	const { baseImage, port, appPath, entry, turboPackage, packageManager, healthCheckPath = "/health" } = options;
 	const pm = getPmConfig(packageManager);
 	const installPm = pm.install ? `RUN ${pm.install}` : "";
 	const turboInstallCmd = getTurboInstallCmd(packageManager);
 	return `# syntax=docker/dockerfile:1
+# Entry-based Dockerfile with turbo prune + tsdown bundling
+
 # Stage 1: Prune monorepo
 FROM ${baseImage} AS pruner
 
@@ -4252,11 +4443,11 @@ ${installPm}
 COPY --from=pruner /app/out/${pm.lockfile} ./
 COPY --from=pruner /app/out/json/ ./
 
-# Install dependencies (no frozen-lockfile since turbo prune creates a subset)
+# Install dependencies
 RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
     ${turboInstallCmd}
 
-# Stage 3: Build
+# Stage 3: Build with tsdown
 FROM deps AS builder
 
 WORKDIR /app
@@ -4264,501 +4455,149 @@ WORKDIR /app
 # Copy pruned source
 COPY --from=pruner /app/out/full/ ./
 
-# Build any workspace packages the app depends on.
-#
-# A no-op for a project whose dependencies come from a registry, and required
-# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
-# workspace package's \`dist\` never reaches the image and its bin has nothing to
-# import. \`--if-present\` is what makes the same Dockerfile correct for both.
-RUN ${pm.run} --if-present build
-
-# Build production server using gkm
-RUN ${pm.exec} gkm build --provider server --production
+# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
+# Using wildcard to make it optional for single-app projects
+COPY --from=pruner /app/tsconfig.* ./
 
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER hono
-
-EXPOSE ${port}
+# Bundle entry point with esbuild (outputs to dist/index.mjs)
+# Creates a fully standalone bundle with all dependencies included
+# Use define to embed credentials if present.
+# They arrive as a build secret (\`docker build --secret id=gkm_credentials,src=…\`),
+# not an ARG: an ARG is recorded in the image history. Two lines, ciphertext
+# then IV; absent when the app has no secrets.
+RUN --mount=type=secret,id=gkm_credentials,required=false \
+    cd ${appPath} && \
+    if [ -s /run/secrets/gkm_credentials ]; then \
+      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \
+      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \
+      npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
+        --outfile=dist/index.mjs --packages=bundle \
+        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);' \
+        --define:__GKM_ENCRYPTED_CREDENTIALS__="'\\"$CREDS\\"'" \
+        --define:__GKM_CREDENTIALS_IV__="'\\"$IV\\"'"; \
+    else \
+      npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
+        --outfile=dist/index.mjs --packages=bundle \
+        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);'; \
+    fi
 
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
-}
-/**
-* Generate a slim Dockerfile for pre-built bundles
-*/
-function generateSlimDockerfile(options) {
-	const { baseImage, port, healthCheckPath, bundle = ".gkm/server/dist/server.mjs" } = options;
-	return `# Slim Dockerfile for pre-built production bundle
-FROM ${baseImage}
+# Stage 4: Production
+FROM ${baseImage} AS runner
 
 WORKDIR /app
 
-# Install tini for proper signal handling as PID 1
-# Handles SIGTERM propagation and zombie process reaping
 RUN apk add --no-cache tini
 
-# Create non-root user
 RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
+    adduser --system --uid 1001 app
 
-# Copy pre-built bundle
-COPY ${bundle} ./
+# Copy bundled output only (no node_modules needed - fully bundled)
+COPY --from=builder --chown=app:nodejs /app/${appPath}/dist/index.mjs ./
 
-# Environment
 ENV NODE_ENV=production
 ENV PORT=${port}
 
-# Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
   CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
 
-# Switch to non-root user
-USER hono
+USER app
 
 EXPOSE ${port}
 
-# Use tini as entrypoint to handle PID 1 responsibilities
 ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
-}
-/**
-* Generate .dockerignore file
-*/
-function generateDockerignore() {
-	return `# Dependencies
-node_modules
-.pnpm-store
-
-# Build output (except what we need)
-.gkm/aws*
-.gkm/server/*.ts
-!.gkm/server/dist
-
-# The key gkm build --stage encrypted secrets with: runtime env only, never
-# the build context
-.gkm/server/master.key
-
-# gkm compose's stacks: each app's env file holds its stage's secrets
-.gkm/compose
-
-# IDE and editor
-.idea
-.vscode
-*.swp
-*.swo
-
-# Git
-.git
-.gitignore
-
-# Logs
-*.log
-npm-debug.log*
-pnpm-debug.log*
-
-# Test files
-**/*.test.ts
-**/*.spec.ts
-**/__tests__
-coverage
-
-# Documentation
-docs
-*.md
-!README.md
-
-# Environment files (handle secrets separately)
-.env
-.env.*
-!.env.example
-
-# Docker files (don't copy recursively)
-Dockerfile*
-docker-compose*
-.dockerignore
-`;
-}
-/**
-* Generate docker-entrypoint.sh for custom startup logic
-*/
-function generateDockerEntrypoint() {
-	return `#!/bin/sh
-set -e
-
-# Run any custom startup scripts here
-# Example: wait for database
-# until nc -z $DB_HOST $DB_PORT; do
-#   echo "Waiting for database..."
-#   sleep 1
-# done
-
-# Execute the main command
-exec "$@"
+CMD ["node", "index.mjs"]
 `;
 }
 /**
-* Resolve Docker configuration from GkmConfig with defaults
-*/
-function resolveDockerConfig(config) {
-	const docker = config.docker ?? {};
-	return {
-		registry: docker.registry ?? "",
-		imageName: docker.imageName ?? config.name ?? "api",
-		baseImage: docker.baseImage ?? "node:22-alpine",
-		port: docker.port ?? 3e3
-	};
-}
-/**
-* Generate a Dockerfile for Next.js frontend apps using standalone output.
-* Uses turbo prune for monorepo optimization.
+* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
+* Remix). Builds with turbo, then runs the framework's production start
+* script via `npm start`.
+*
+* Public URL build args are declared so framework bundlers (Vite, Vinxi)
+* can inline them at build time. Per-framework prefix is the caller's job.
 * @internal Exported for testing
 */
-function generateNextjsDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
+function generateNodeWebDockerfile(options) {
+	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
 	const pm = getPmConfig(packageManager);
 	const installPm = pm.install ? `RUN ${pm.install}` : "";
 	const turboInstallCmd = getTurboInstallCmd(packageManager);
 	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
-	const publicUrlArgDeclarations = publicUrlArgs.map((arg) => `ARG ${arg}=""`).join("\n");
-	const publicUrlEnvDeclarations = publicUrlArgs.map((arg) => `ENV ${arg}=$${arg}`).join("\n");
+	const startCmd = packageManager === "pnpm" ? "pnpm start" : `${pm.lockfile.startsWith("package-lock") ? "npm" : packageManager} start`;
+	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
+	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
 	return `# syntax=docker/dockerfile:1
-# Next.js standalone Dockerfile with turbo prune optimization
+# Node SSR web Dockerfile (TanStack Start / Remix) with turbo prune
 
-# Stage 1: Prune monorepo
 FROM ${baseImage} AS pruner
-
 WORKDIR /app
-
 ${installPm}
-
 COPY . .
-
-# Prune to only include necessary packages
 RUN ${turboCmd} prune ${turboPackage} --docker
 
-# Stage 2: Install dependencies
 FROM ${baseImage} AS deps
-
 WORKDIR /app
-
 ${installPm}
-
-# Copy pruned lockfile and package.jsons
 COPY --from=pruner /app/out/${pm.lockfile} ./
 COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies
 RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
     ${turboInstallCmd}
 
-# Stage 3: Build
 FROM deps AS builder
-
 WORKDIR /app
-
-# Build-time args for public API URLs (populated by gkm deploy)
-# These get baked into the Next.js build as public environment variables
-${publicUrlArgDeclarations}
-
-# Convert ARGs to ENVs for Next.js build
-${publicUrlEnvDeclarations}
-
-# Copy pruned source
+${argDecls}
+${envDecls}
 COPY --from=pruner /app/out/full/ ./
-
-# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
-# Using wildcard to make it optional for single-app projects
 COPY --from=pruner /app/tsconfig.* ./
-
-# Ensure public directory exists (may be empty for scaffolded projects)
-RUN mkdir -p ${appPath}/public
-
-# Set Next.js to produce standalone output
-ENV NEXT_TELEMETRY_DISABLED=1
-
-# Build the application
 RUN ${turboCmd} run build --filter=${turboPackage}
 
-# Stage 4: Production
 FROM ${baseImage} AS runner
-
 WORKDIR /app
-
-# Install tini for proper signal handling
 RUN apk add --no-cache tini
-
-# Create non-root user
 RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 nextjs
+    adduser --system --uid 1001 app
+
+# Copy the whole built workspace — frameworks differ on output paths
+COPY --from=builder --chown=app:nodejs /app/ ./
 
-# Set environment
 ENV NODE_ENV=production
-ENV NEXT_TELEMETRY_DISABLED=1
 ENV PORT=${port}
 ENV HOSTNAME="0.0.0.0"
 
-# Copy static files and standalone output
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/static ./${appPath}/.next/static
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/public ./${appPath}/public
-
-USER nextjs
-
+USER app
 EXPOSE ${port}
 
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+
 ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "${appPath}/server.js"]
+CMD ["sh", "-c", "cd ${appPath} && ${startCmd}"]
 `;
 }
 /**
-* Generate a Dockerfile for backend apps in a workspace.
-* Uses turbo prune for monorepo optimization.
+* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
+* turbo, then serves it via nginx.
 * @internal Exported for testing
 */
-function generateBackendDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, healthCheckPath = "/health" } = options;
+function generateViteStaticDockerfile(options) {
+	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
 	const pm = getPmConfig(packageManager);
 	const installPm = pm.install ? `RUN ${pm.install}` : "";
 	const turboInstallCmd = getTurboInstallCmd(packageManager);
+	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
+	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
+	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
 	return `# syntax=docker/dockerfile:1
-# Backend Dockerfile with turbo prune optimization
+# Vite SPA Dockerfile — builds static assets, serves via nginx
 
-# Stage 1: Prune monorepo
 FROM ${baseImage} AS pruner
-
 WORKDIR /app
-
 ${installPm}
-
 COPY . .
-
-# Prune to only include necessary packages
-RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
-
-# Stage 2: Install dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-
-${installPm}
-
-# Copy pruned lockfile and package.jsons
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-# Stage 3: Build
-FROM deps AS builder
-
-WORKDIR /app
-
-# Copy pruned source
-COPY --from=pruner /app/out/full/ ./
-
-# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
-# Using wildcard to make it optional for single-app projects
-COPY --from=pruner /app/gkm.config.* ./
-COPY --from=pruner /app/tsconfig.* ./
-
-# Write encrypted credentials for gkm build to embed.
-# A build secret (\`docker build --secret id=gkm_credentials,src=…\`), not an
-# ARG: an ARG is recorded in the image history. Two lines, ciphertext then IV;
-# absent when the app has no secrets.
-RUN --mount=type=secret,id=gkm_credentials,required=false \
-    if [ -s /run/secrets/gkm_credentials ]; then \
-      mkdir -p ${appPath}/.gkm && \
-      sed -n 1p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.enc && \
-      sed -n 2p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.iv; \
-    fi
-
-# Build any workspace packages the app depends on.
-#
-# A no-op for a project whose dependencies come from a registry, and required
-# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
-# workspace package's \`dist\` never reaches the image and its bin has nothing to
-# import. \`--if-present\` is what makes the same Dockerfile correct for both.
-RUN ${pm.run} --if-present build
-
-# Build production server using gkm
-RUN cd ${appPath} && ${pm.exec} gkm build --provider server --production
-
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-# Copy bundled server
-COPY --from=builder --chown=hono:nodejs /app/${appPath}/.gkm/server/dist/server.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER hono
-
-EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
-}
-/**
-* Generate a Dockerfile for apps with a custom entry point.
-* Uses esbuild to bundle the entry point into dist/index.mjs with all dependencies.
-* This is used for apps that don't use gkm routes (e.g., Better Auth servers).
-* @internal Exported for testing
-*/
-function generateEntryDockerfile(options) {
-	const { baseImage, port, appPath, entry, turboPackage, packageManager, healthCheckPath = "/health" } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	return `# syntax=docker/dockerfile:1
-# Entry-based Dockerfile with turbo prune + tsdown bundling
-
-# Stage 1: Prune monorepo
-FROM ${baseImage} AS pruner
-
-WORKDIR /app
-
-${installPm}
-
-COPY . .
-
-# Prune to only include necessary packages
-RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
-
-# Stage 2: Install dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-
-${installPm}
-
-# Copy pruned lockfile and package.jsons
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-# Stage 3: Build with tsdown
-FROM deps AS builder
-
-WORKDIR /app
-
-# Copy pruned source
-COPY --from=pruner /app/out/full/ ./
-
-# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
-# Using wildcard to make it optional for single-app projects
-COPY --from=pruner /app/tsconfig.* ./
-
-# Bundle entry point with esbuild (outputs to dist/index.mjs)
-# Creates a fully standalone bundle with all dependencies included
-# Use define to embed credentials if present.
-# They arrive as a build secret (\`docker build --secret id=gkm_credentials,src=…\`),
-# not an ARG: an ARG is recorded in the image history. Two lines, ciphertext
-# then IV; absent when the app has no secrets.
-RUN --mount=type=secret,id=gkm_credentials,required=false \
-    cd ${appPath} && \
-    if [ -s /run/secrets/gkm_credentials ]; then \
-      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \
-      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \
-      npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
-        --outfile=dist/index.mjs --packages=bundle \
-        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);' \
-        --define:__GKM_ENCRYPTED_CREDENTIALS__="'\\"$CREDS\\"'" \
-        --define:__GKM_CREDENTIALS_IV__="'\\"$IV\\"'"; \
-    else \
-      npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
-        --outfile=dist/index.mjs --packages=bundle \
-        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);'; \
-    fi
-
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 app
-
-# Copy bundled output only (no node_modules needed - fully bundled)
-COPY --from=builder --chown=app:nodejs /app/${appPath}/dist/index.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER app
-
-EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "index.mjs"]
-`;
-}
-/**
-* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
-* Remix). Builds with turbo, then runs the framework's production start
-* script via `npm start`.
-*
-* Public URL build args are declared so framework bundlers (Vite, Vinxi)
-* can inline them at build time. Per-framework prefix is the caller's job.
-* @internal Exported for testing
-*/
-function generateNodeWebDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
-	const startCmd = packageManager === "pnpm" ? "pnpm start" : `${pm.lockfile.startsWith("package-lock") ? "npm" : packageManager} start`;
-	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
-	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
-	return `# syntax=docker/dockerfile:1
-# Node SSR web Dockerfile (TanStack Start / Remix) with turbo prune
-
-FROM ${baseImage} AS pruner
-WORKDIR /app
-${installPm}
-COPY . .
-RUN ${turboCmd} prune ${turboPackage} --docker
+RUN ${turboCmd} prune ${turboPackage} --docker
 
 FROM ${baseImage} AS deps
 WORKDIR /app
@@ -4776,70 +4615,17 @@ COPY --from=pruner /app/out/full/ ./
 COPY --from=pruner /app/tsconfig.* ./
 RUN ${turboCmd} run build --filter=${turboPackage}
 
-FROM ${baseImage} AS runner
-WORKDIR /app
-RUN apk add --no-cache tini
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 app
-
-# Copy the whole built workspace — frameworks differ on output paths
-COPY --from=builder --chown=app:nodejs /app/ ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-ENV HOSTNAME="0.0.0.0"
-
-USER app
+FROM nginx:alpine AS runner
+COPY --from=builder /app/${appPath}/dist /usr/share/nginx/html
+RUN printf 'server {\\n  listen ${port};\\n  root /usr/share/nginx/html;\\n  index index.html;\\n  location / { try_files $uri $uri/ /index.html; }\\n}\\n' \\
+    > /etc/nginx/conf.d/default.conf
 EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["sh", "-c", "cd ${appPath} && ${startCmd}"]
-`;
-}
-/**
-* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
-* turbo, then serves it via nginx.
-* @internal Exported for testing
-*/
-function generateViteStaticDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
-	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
-	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
-	return `# syntax=docker/dockerfile:1
-# Vite SPA Dockerfile — builds static assets, serves via nginx
-
-FROM ${baseImage} AS pruner
-WORKDIR /app
-${installPm}
-COPY . .
-RUN ${turboCmd} prune ${turboPackage} --docker
-
-FROM ${baseImage} AS deps
-WORKDIR /app
-${installPm}
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-FROM deps AS builder
-WORKDIR /app
-${argDecls}
-${envDecls}
-COPY --from=pruner /app/out/full/ ./
-COPY --from=pruner /app/tsconfig.* ./
-RUN ${turboCmd} run build --filter=${turboPackage}
-
-FROM nginx:alpine AS runner
-COPY --from=builder /app/${appPath}/dist /usr/share/nginx/html
-RUN printf 'server {\\n  listen ${port};\\n  root /usr/share/nginx/html;\\n  index index.html;\\n  location / { try_files $uri $uri/ /index.html; }\\n}\\n' \\
-    > /etc/nginx/conf.d/default.conf
-EXPOSE ${port}
-CMD ["nginx", "-g", "daemon off;"]
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+CMD ["nginx", "-g", "daemon off;"]
 `;
 }
 //#endregion
@@ -4849,1403 +4635,616 @@ const logger = output;
 var DockerBuildFailed = class extends Error {
 	imageRef;
 	constructor(imageRef, cause) {
-		super(`Failed to build Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-		this.imageRef = imageRef;
-		this.name = "DockerBuildFailed";
-	}
-};
-/** `docker push` failed — usually the registry login or its permissions. */
-var DockerPushFailed = class extends Error {
-	imageRef;
-	constructor(imageRef, cause) {
-		super(`Failed to push Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-		this.imageRef = imageRef;
-		this.name = "DockerPushFailed";
-	}
-};
-/** `gkm docker --push` was asked for with nowhere to push to. */
-var PushNeedsRegistry = class extends Error {
-	imageName;
-	constructor(imageName) {
-		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
-		this.imageName = imageName;
-		this.name = "PushNeedsRegistry";
-	}
-};
-/**
-* Docker command implementation
-* Generates Dockerfile, docker-compose.yml, and related files
-*
-* Default: Multi-stage Dockerfile that builds from source inside Docker
-* --slim: Slim Dockerfile that copies pre-built bundle (requires prior build)
-*/
-async function dockerCommand(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const loadedConfig = await loadWorkspaceConfig(cwd);
-	if (loadedConfig.type === "workspace") {
-		logger.log("📦 Detected workspace configuration");
-		return workspaceDockerCommand(loadedConfig.workspace, loadedConfig.manifest);
-	}
-	const dockerConfig = resolveDockerConfig(await loadConfig(cwd));
-	const healthCheckPath = "/health";
-	const useSlim = options.slim === true;
-	if (useSlim) {
-		const distDir = join(cwd, ".gkm", "server", "dist");
-		if (!existsSync(join(distDir, "server.mjs"))) throw new Error("Slim Dockerfile requires a pre-built bundle. Run `gkm build --provider server --production` first, or omit --slim to use multi-stage build.");
-	}
-	const dockerDir = join(cwd, ".gkm", "docker");
-	await mkdir(dockerDir, { recursive: true });
-	const packageManager = detectPackageManager(cwd);
-	const inMonorepo = isMonorepo(cwd);
-	const hasTurbo = hasTurboConfig(cwd);
-	let useTurbo = options.turbo ?? false;
-	if (inMonorepo && !useSlim) {
-		if (hasTurbo) {
-			useTurbo = true;
-			logger.log("   Detected monorepo with turbo.json - using turbo prune");
-		} else throw new Error("Monorepo detected but turbo.json not found.\n\nDocker builds in monorepos require Turborepo for proper dependency isolation.\n\nTo fix this:\n  1. Install turbo: pnpm add -Dw turbo\n  2. Create turbo.json in your monorepo root\n  3. Run this command again\n\nSee: https://turbo.build/repo/docs/guides/tools/docker");
-	}
-	let turboPackage = options.turboPackage ?? dockerConfig.imageName;
-	if (useTurbo && !options.turboPackage) try {
-		const pkg = __require(`${cwd}/package.json`);
-		if (pkg.name) {
-			turboPackage = pkg.name;
-			logger.log(`   Turbo package: ${turboPackage}`);
-		}
-	} catch {}
-	const templateOptions = {
-		imageName: dockerConfig.imageName,
-		baseImage: dockerConfig.baseImage,
-		port: dockerConfig.port,
-		healthCheckPath,
-		prebuilt: useSlim,
-		turbo: useTurbo,
-		turboPackage,
-		packageManager
-	};
-	const dockerfile = useSlim ? generateSlimDockerfile(templateOptions) : generateMultiStageDockerfile(templateOptions);
-	const dockerMode = useSlim ? "slim" : useTurbo ? "turbo" : "multi-stage";
-	const dockerfilePath = join(dockerDir, "Dockerfile");
-	await writeFile(dockerfilePath, dockerfile);
-	logger.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
-	const composePath = await writeConstructsCompose(loadedConfig.workspace);
-	const dockerignore = generateDockerignore();
-	const dockerignorePath = join(cwd, ".dockerignore");
-	await writeFile(dockerignorePath, dockerignore);
-	logger.log("Generated: .dockerignore (project root)");
-	const entrypoint = generateDockerEntrypoint();
-	const entrypointPath = join(dockerDir, "docker-entrypoint.sh");
-	await writeFile(entrypointPath, entrypoint);
-	logger.log("Generated: .gkm/docker/docker-entrypoint.sh");
-	const result = {
-		dockerfile: dockerfilePath,
-		dockerCompose: composePath,
-		dockerignore: dockerignorePath,
-		entrypoint: entrypointPath
-	};
-	if (options.build) await buildDockerImage(dockerConfig.imageName, options, cwd);
-	if (options.push) await pushDockerImage(dockerConfig.imageName, options, cwd);
-	return result;
-}
-/**
-* Ensure lockfile exists in the build context
-* For monorepos, copies from workspace root if needed
-* Returns cleanup function if file was copied
-*/
-function ensureLockfile(cwd) {
-	const lockfilePath = findLockfilePath(cwd);
-	if (!lockfilePath) {
-		logger.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
-		return null;
-	}
-	const lockfileName = basename(lockfilePath);
-	const localLockfile = join(cwd, lockfileName);
-	if (lockfilePath === localLockfile) return null;
-	logger.log(`   Copying ${lockfileName} from monorepo root...`);
-	copyFileSync(lockfilePath, localLockfile);
-	return () => {
-		try {
-			unlinkSync(localLockfile);
-		} catch {}
-	};
-}
-/**
-* Build Docker image
-* Uses BuildKit for cache mount support
-*/
-async function buildDockerImage(imageName, options, cwd) {
-	const tag = options.tag ?? "latest";
-	const registry = options.registry;
-	const fullImageName = validateImageRef(registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`);
-	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
-	const cleanup = ensureLockfile(cwd);
-	try {
-		await run$1("docker", [
-			"build",
-			"--file=.gkm/docker/Dockerfile",
-			`--tag=${fullImageName}`,
-			"."
-		], {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			}
-		});
-		logger.log(`✅ Docker image built: ${fullImageName}`);
-	} catch (error) {
-		throw new DockerBuildFailed(fullImageName, error);
-	} finally {
-		cleanup?.();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushDockerImage(imageName, options, cwd) {
-	const tag = options.tag ?? "latest";
-	const registry = options.registry;
-	if (!registry) throw new PushNeedsRegistry(imageName);
-	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
-	try {
-		await run$1("docker", ["push", fullImageName], { cwd });
-		logger.log(`✅ Docker image pushed: ${fullImageName}`);
-	} catch (error) {
-		throw new DockerPushFailed(fullImageName, error);
-	}
-}
-/**
-* Get the package name from package.json in an app directory.
-*/
-function getAppPackageName(appPath) {
-	try {
-		const pkgPath = join(appPath, "package.json");
-		if (!existsSync(pkgPath)) return;
-		const content = readFileSync(pkgPath, "utf-8");
-		return JSON.parse(content).name;
-	} catch {
-		return;
-	}
-}
-/**
-* Generate Dockerfiles for all apps in a workspace.
-* @internal Exported for testing
-*/
-async function workspaceDockerCommand(workspace, manifest) {
-	const results = [];
-	const apps = Object.entries(workspace.apps);
-	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	const dockerDir = join(workspace.root, ".gkm", "docker");
-	await mkdir(dockerDir, { recursive: true });
-	const packageManager = detectPackageManager(workspace.root);
-	logger.log(`   Package manager: ${packageManager}`);
-	for (const [appName, app] of apps) {
-		if (app.type === "mobile") {
-			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
-			continue;
-		}
-		const appPath = app.path;
-		const turboPackage = getAppPackageName(join(workspace.root, appPath)) ?? appName;
-		const imageName = appName;
-		const buildType = !!app.entry ? "entry" : app.type;
-		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
-		let dockerfile;
-		if (app.type === "web") dockerfile = siteDockerfile(appName, app, {
-			turboPackage,
-			packageManager,
-			...manifest ? { manifest } : {}
-		});
-		else if (app.entry) dockerfile = generateEntryDockerfile({
-			imageName,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			appPath,
-			entry: app.entry,
-			turboPackage,
-			packageManager,
-			healthCheckPath: "/health"
-		});
-		else dockerfile = generateBackendDockerfile({
-			imageName,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			appPath,
-			turboPackage,
-			packageManager,
-			healthCheckPath: "/health"
-		});
-		const dockerfilePath = join(dockerDir, `Dockerfile.${appName}`);
-		await writeFile(dockerfilePath, dockerfile);
-		logger.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
-		results.push({
-			appName,
-			type: app.type,
-			dockerfile: dockerfilePath,
-			imageName
-		});
-	}
-	const dockerignore = generateDockerignore();
-	const dockerignorePath = join(workspace.root, ".dockerignore");
-	await writeFile(dockerignorePath, dockerignore);
-	logger.log(`\n   Generated: .dockerignore (workspace root)`);
-	const composePath = await writeConstructsCompose(workspace);
-	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger.log("\n📋 Build commands:");
-	for (const result of results) {
-		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
-	}
-	printRunInstructions(workspace);
-	return {
-		apps: results,
-		dockerCompose: composePath,
-		dockerignore: dockerignorePath
-	};
-}
-/**
-* A site's Dockerfile, with an `ARG` for every key its bundler inlines.
-*
-* The keys come from the site's declaration where there is one — every
-* public key its edges give it, `VITE_UPLOADS_SERVER_URL` included — and an
-* `ARG` the Dockerfile does not declare is a build argument the build drops,
-* leaving the bundle with an empty URL.
-*/
-function siteDockerfile(appName, app, options) {
-	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && appKey(id) === appName)?.[1] : void 0;
-	const publicUrlArgs = declared?.kind === "site" && options.manifest ? Object.keys(publicEnvFor(declared, options.manifest)) : getPublicUrlArgNames(app);
-	const webOpts = {
-		imageName: appName,
-		baseImage: "node:22-alpine",
-		port: app.port,
-		appPath: app.path,
-		turboPackage: options.turboPackage,
-		packageManager: options.packageManager,
-		publicUrlArgs
-	};
-	switch (app.framework) {
-		case "vite": return generateViteStaticDockerfile(webOpts);
-		case "tanstack-start":
-		case "remix": return generateNodeWebDockerfile(webOpts);
-		default: return generateNextjsDockerfile(webOpts);
-	}
-}
-/**
-* The package name turbo prunes an app by: its package.json's, or its name.
-*/
-function appPackageName(root, appName, path) {
-	return getAppPackageName(join(root, path)) ?? appName;
-}
-/**
-* Write `docker-compose.constructs.yml` — the same file `gkm dev` writes, with
-* the apps beside the containers their constructs derive.
-*
-* Through reconcile rather than a second generator, so what `gkm docker`
-* describes and what `gkm dev` runs cannot disagree. Nothing is started.
-*/
-async function writeConstructsCompose(workspace) {
-	await reconcileWorkspace(workspace, {
-		stage: workspace.stages.local,
-		start: false
-	});
-	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
-	return join(workspace.root, COMPOSE_PATH);
-}
-function printRunInstructions(workspace) {
-	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger.log("   gkm setup   # starts the containers and creates what they hold");
-	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
-}
-//#endregion
-//#region src/deploy/dokploy-api.ts
-var dokploy_api_exports = /* @__PURE__ */ __exportAll({
-	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
-	DokployApi: () => DokployApi,
-	DokployApiError: () => DokployApiError,
-	DokployRequestTimedOut: () => DokployRequestTimedOut
-});
-/** Per request, so a stalled server fails the deploy, not the CI job. */
-const DEFAULT_DOKPLOY_TIMEOUT_MS = 3e4;
-/**
-* Dokploy accepted the connection but did not answer in time.
-*
-* Not retried: a request that arrived and stalled may still be acted on, and
-* sending it again could repeat a deploy or a create the server is already
-* doing.
-*/
-var DokployRequestTimedOut = class extends Error {
-	baseUrl;
-	endpoint;
-	timeoutMs;
-	constructor(baseUrl, endpoint, timeoutMs) {
-		super(`Dokploy at ${baseUrl} did not answer ${endpoint} within ${timeoutMs}ms. Check that the Dokploy server is healthy, or raise \`timeoutMs\` if this call is known to be slow.`);
-		this.baseUrl = baseUrl;
-		this.endpoint = endpoint;
-		this.timeoutMs = timeoutMs;
-		this.name = "DokployRequestTimedOut";
-	}
-};
-/**
-* Waits `ms` between retries, or rejects with the signal's reason the moment
-* it aborts — a caller who gave up should not sit through the backoff.
-*/
-function pause(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) {
-			reject(signal.reason);
-			return;
-		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason);
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-var DokployApiError = class extends Error {
-	status;
-	statusText;
-	issues;
-	constructor(message, status, statusText, issues) {
-		super(message);
-		this.status = status;
-		this.statusText = statusText;
-		this.issues = issues;
-		this.name = "DokployApiError";
-	}
-};
-/**
-* Dokploy API client
-*/
-var DokployApi = class {
-	baseUrl;
-	token;
-	timeoutMs;
-	signal;
-	constructor(options) {
-		this.baseUrl = options.baseUrl.replace(/\/$/, "");
-		this.token = options.token;
-		this.timeoutMs = options.timeoutMs ?? 3e4;
-		this.signal = options.signal;
-	}
-	/**
-	* Make a GET request to the Dokploy API
-	*/
-	async get(endpoint) {
-		return this.request("GET", endpoint);
-	}
-	/**
-	* Make a POST request to the Dokploy API
-	*/
-	async post(endpoint, body) {
-		return this.request("POST", endpoint, body);
-	}
-	/**
-	* Make a request to the Dokploy API
-	*/
-	async request(method, endpoint, body) {
-		const url = `${this.baseUrl}/api/${endpoint}`;
-		let response;
-		let timeout;
-		let lastError;
-		for (let attempt = 1; attempt <= 3; attempt++) {
-			this.signal?.throwIfAborted();
-			timeout = AbortSignal.timeout(this.timeoutMs);
-			try {
-				response = await fetch(url, {
-					method,
-					headers: {
-						"Content-Type": "application/json",
-						"x-api-key": this.token
-					},
-					body: body ? JSON.stringify(body) : void 0,
-					signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
-				});
-				break;
-			} catch (error) {
-				const stopped = this.stopped(timeout, endpoint);
-				if (stopped) throw stopped;
-				lastError = error;
-				if (attempt === 3) break;
-				await pause(attempt * 750, this.signal);
-			}
-		}
-		if (!response || !timeout) {
-			const detail = lastError instanceof Error ? lastError.message : String(lastError);
-			throw new DokployApiError(`Could not reach Dokploy at ${this.baseUrl} (${endpoint}): ${detail}`, 0, "Network error");
-		}
-		try {
-			return await this.read(response);
-		} catch (error) {
-			throw this.stopped(timeout, endpoint) ?? error;
-		}
-	}
-	/**
-	* What a request cut short should reject with: the caller's own reason
-	* when they aborted, `DokployRequestTimedOut` when the deadline passed,
-	* nothing when it was neither.
-	*/
-	stopped(timeout, endpoint) {
-		if (this.signal?.aborted) return this.signal.reason;
-		if (timeout.aborted) return new DokployRequestTimedOut(this.baseUrl, endpoint, this.timeoutMs);
-	}
-	/** Turns a response into its JSON body, or a `DokployApiError`. */
-	async read(response) {
-		if (!response.ok) {
-			let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
-			let issues;
-			try {
-				const errorBody = await response.json();
-				if (errorBody.message) errorMessage = `Dokploy API error: ${errorBody.message}`;
-				if (errorBody.issues?.length) {
-					issues = errorBody.issues;
-					errorMessage += `\n  Issues: ${errorBody.issues.map((i) => i.message).join(", ")}`;
-				}
-			} catch {}
-			throw new DokployApiError(errorMessage, response.status, response.statusText, issues);
-		}
-		const text = await response.text();
-		if (!text || text.trim() === "") return;
-		return JSON.parse(text);
-	}
-	/**
-	* Every external port published on this server, across every project.
-	*
-	* Dokploy knows what it has bound; guessing does not. A port that looks free
-	* from here can be held by a service in a project this deploy has never
-	* heard of — which surfaces as `Port 5432 is already in use by container
-	* "…"`, naming something the caller cannot see.
-	*
-	* `project.all` is a summary, so each project is fetched: the per-service
-	* `externalPort` only appears on `project.one`.
-	*/
-	async publishedPorts() {
-		const ports = /* @__PURE__ */ new Set();
-		const projects = await this.listProjects();
-		for (const project of projects) {
-			const details = await this.getProject(project.projectId);
-			for (const environment of details.environments ?? []) {
-				const resources = [
-					...environment.postgres ?? [],
-					...environment.redis ?? [],
-					...environment.applications ?? []
-				];
-				for (const resource of resources) if (typeof resource.externalPort === "number") ports.add(resource.externalPort);
-			}
-		}
-		return ports;
-	}
-	/**
-	* Validate the API token by making a test request
-	*/
-	async validateToken() {
-		try {
-			await this.get("project.all");
-			return true;
-		} catch {
-			return false;
-		}
-	}
-	/**
-	* List all projects
-	*/
-	async listProjects() {
-		return this.get("project.all");
-	}
-	/**
-	* Get a single project by ID
-	*/
-	async getProject(projectId) {
-		return this.get(`project.one?projectId=${projectId}`);
-	}
-	/**
-	* Create a new project
-	*/
-	async createProject(name, description) {
-		return this.post("project.create", {
-			name,
-			description: description ?? `Created by gkm CLI`
-		});
-	}
-	/**
-	* Change a project's name or description.
-	*
-	* The name is sent with the description because `project.update` validates
-	* the whole project on some Dokploy versions, and a missing name fails it.
-	*/
-	async updateProject(projectId, updates) {
-		await this.post("project.update", {
-			projectId,
-			...updates
-		});
-	}
-	/**
-	* Delete a project and all its resources
-	*/
-	async deleteProject(projectId) {
-		await this.post("project.remove", { projectId });
-	}
-	/**
-	* Create an environment in a project
-	*/
-	async createEnvironment(projectId, name, description) {
-		return this.post("environment.create", {
-			projectId,
-			name,
-			description: description ?? `${name} environment`
-		});
-	}
-	/**
-	* List all applications in a project
-	*/
-	async listApplications(projectId) {
-		return this.listInProject(projectId, (env) => env.applications);
-	}
-	/**
-	* Everything of one kind in a project, across its environments.
-	*
-	* From `project.one`, because the per-kind `*.all?projectId=` endpoints
-	* return **404** on current Dokploy: resources live under environments now.
-	* Those calls used to be wrapped in `catch { return [] }`, which turned "I
-	* could not ask" into "there are none" — and for a find-or-create that is
-	* the worst available answer. Every deploy created a second application, a
-	* second Postgres and a second Redis, silently, for as long as the project
-	* existed.
-	*
-	* A failure here is not swallowed: creating a duplicate is worse than
-	* stopping.
-	*/
-	async listInProject(projectId, pick) {
-		return ((await this.getProject(projectId)).environments ?? []).flatMap((environment) => (pick(environment) ?? []).map((resource) => ({
-			...resource,
-			environmentId: environment.environmentId
-		})));
-	}
-	/**
-	* Find an application by name in a project
-	*/
-	async findApplicationByName(projectId, name, environmentId) {
-		const applications = await this.listApplications(projectId);
-		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-		return applications.find((app) => (!environmentId || app.environmentId === environmentId) && (app.name === name || app.appName === normalizedName));
-	}
-	/**
-	* Create a new application
-	*/
-	async createApplication(name, projectId, environmentId) {
-		return this.post("application.create", {
-			name,
-			projectId,
-			environmentId,
-			appName: name.toLowerCase().replace(/[^a-z0-9-]/g, "-")
-		});
-	}
-	/**
-	* Find or create an application by name
-	*/
-	async findOrCreateApplication(name, projectId, environmentId) {
-		const existing = await this.findApplicationByName(projectId, name, environmentId);
-		if (existing) return {
-			application: existing,
-			created: false
-		};
-		return {
-			application: await this.createApplication(name, projectId, environmentId),
-			created: true
-		};
-	}
-	/**
-	* Get an application by ID
-	*/
-	async getApplication(applicationId) {
-		try {
-			return await this.get(`application.one?applicationId=${applicationId}`);
-		} catch {
-			return null;
-		}
-	}
-	/**
-	* Update an application
-	*/
-	async updateApplication(applicationId, updates) {
-		await this.post("application.update", {
-			applicationId,
-			...updates
-		});
-	}
-	/**
-	* Save environment variables for an application
-	*/
-	async saveApplicationEnv(applicationId, env, options) {
-		await this.post("application.saveEnvironment", {
-			applicationId,
-			env,
-			buildArgs: options?.buildArgs ?? null,
-			buildSecrets: options?.buildSecrets ?? null,
-			createEnvFile: false
-		});
-	}
-	/**
-	* Configure application to use Docker provider (pull from registry)
-	*
-	* For private registries, either:
-	* - Use `registryId` if the registry is configured in Dokploy
-	* - Or provide `username`, `password`, and `registryUrl` directly
-	*/
-	async saveDockerProvider(applicationId, dockerImage, options) {
-		await this.post("application.saveDockerProvider", {
-			applicationId,
-			dockerImage,
-			...options,
-			username: options?.username ?? null,
-			password: options?.password ?? null,
-			registryUrl: options?.registryUrl ?? null
-		});
-	}
-	/**
-	* Deploy an application
-	*/
-	async deployApplication(applicationId) {
-		await this.post("application.deploy", { applicationId });
-	}
-	/**
-	* Delete an application
-	*/
-	async deleteApplication(applicationId) {
-		await this.post("application.remove", { applicationId });
-	}
-	/**
-	* List all registries
-	*/
-	async listRegistries() {
-		return this.get("registry.all");
-	}
-	/**
-	* Create a new registry
-	*/
-	async createRegistry(registryName, registryUrl, username, password, options) {
-		return this.post("registry.create", {
-			registryName,
-			registryUrl,
-			username,
-			password,
-			imagePrefix: options?.imagePrefix
-		});
-	}
-	/**
-	* Get a registry by ID
-	*/
-	async getRegistry(registryId) {
-		return this.get(`registry.one?registryId=${registryId}`);
-	}
-	/**
-	* Update a registry
-	*/
-	async updateRegistry(registryId, updates) {
-		await this.post("registry.update", {
-			registryId,
-			...updates
-		});
-	}
-	/**
-	* Delete a registry
-	*/
-	async deleteRegistry(registryId) {
-		await this.post("registry.remove", { registryId });
-	}
-	/**
-	* List all Postgres databases in a project
-	*/
-	async listPostgres(projectId) {
-		return this.listInProject(projectId, (env) => env.postgres);
-	}
-	/**
-	* Find a Postgres database by name in a project
-	*/
-	async findPostgresByName(projectId, name) {
-		const databases = await this.listPostgres(projectId);
-		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-		const match = databases.find((db) => db.name === name || db.appName === normalizedName);
-		if (!match) return void 0;
-		return this.getPostgres(match.postgresId);
-	}
-	/**
-	* Create a new Postgres database
-	*/
-	async createPostgres(name, projectId, environmentId, options) {
-		return this.post("postgres.create", {
-			name,
-			projectId,
-			environmentId,
-			appName: options?.appName ?? name.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
-			databaseName: options?.databaseName,
-			databaseUser: options?.databaseUser ?? "postgres",
-			databasePassword: options?.databasePassword,
-			dockerImage: options?.dockerImage ?? "postgres:18",
-			description: options?.description ?? `Postgres database for ${name}`
-		});
-	}
-	/**
-	* Find or create a Postgres database by name
-	*/
-	async findOrCreatePostgres(name, projectId, environmentId, options) {
-		const existing = await this.findPostgresByName(projectId, name);
-		if (existing) return {
-			postgres: existing,
-			created: false
-		};
-		return {
-			postgres: await this.createPostgres(name, projectId, environmentId, options),
-			created: true
-		};
-	}
-	/**
-	* Get a Postgres database by ID
-	*/
-	async getPostgres(postgresId) {
-		return this.get(`postgres.one?postgresId=${postgresId}`);
-	}
-	/**
-	* Deploy a Postgres database
-	*/
-	async deployPostgres(postgresId) {
-		await this.post("postgres.deploy", { postgresId });
-	}
-	/**
-	* Save environment variables for Postgres
-	*/
-	async savePostgresEnv(postgresId, env) {
-		await this.post("postgres.saveEnvironment", {
-			postgresId,
-			env
-		});
-	}
-	/**
-	* Set external port for Postgres (for external access)
-	*/
-	async savePostgresExternalPort(postgresId, externalPort) {
-		await this.post("postgres.saveExternalPort", {
-			postgresId,
-			externalPort
-		});
-	}
-	/**
-	* Update Postgres configuration
-	*/
-	async updatePostgres(postgresId, updates) {
-		await this.post("postgres.update", {
-			postgresId,
-			...updates
-		});
-	}
-	/**
-	* Delete a Postgres database
-	*/
-	async deletePostgres(postgresId) {
-		await this.post("postgres.remove", { postgresId });
-	}
-	/**
-	* The compose stacks in a project.
-	*
-	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* MinIO, so an object store is a compose stack — the one kind whose contents
-	* this target writes rather than configures.
-	*/
-	async listCompose(projectId) {
-		return this.listInProject(projectId, (env) => env.compose);
-	}
-	/** A compose stack by name, hydrated — `project.one` returns summaries. */
-	async findComposeByName(projectId, name) {
-		const summary = (await this.listCompose(projectId)).find((compose) => compose.name === name);
-		return summary ? this.getCompose(summary.composeId) : void 0;
-	}
-	async getCompose(composeId) {
-		return this.get(`compose.one?composeId=${composeId}`);
-	}
-	/**
-	* A compose stack carrying the file this target wrote.
-	*
-	* Created empty and then updated, because `compose.create` takes no file:
-	* it defaults to `sourceType: 'github'` and expects a repository. `raw` is
-	* what makes the file ours.
-	*/
-	async findOrCreateCompose(name, projectId, environmentId, composeFile) {
-		const existing = await this.findComposeByName(projectId, name);
-		const compose = existing ?? await this.post("compose.create", {
-			name,
-			environmentId,
-			composeType: "docker-compose"
-		});
-		await this.post("compose.update", {
-			composeId: compose.composeId,
-			sourceType: "raw",
-			composeFile
-		});
-		return {
-			compose,
-			created: !existing
-		};
-	}
-	async deployCompose(composeId) {
-		await this.post("compose.deploy", { composeId });
-	}
-	async deleteCompose(composeId) {
-		await this.post("compose.delete", {
-			composeId,
-			deleteVolumes: false
-		});
-	}
-	/**
-	* List all Redis instances in a project
-	*/
-	async listRedis(projectId) {
-		return this.listInProject(projectId, (env) => env.redis);
-	}
-	/**
-	* Find a Redis instance by name in a project
-	*/
-	async findRedisByName(projectId, name) {
-		const instances = await this.listRedis(projectId);
-		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-		const match = instances.find((redis) => redis.name === name || redis.appName === normalizedName);
-		return match ? this.getRedis(match.redisId) : void 0;
-	}
-	/**
-	* Create a new Redis instance
-	*/
-	async createRedis(name, projectId, environmentId, options) {
-		return this.post("redis.create", {
-			name,
-			projectId,
-			environmentId,
-			appName: options?.appName ?? name.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
-			databasePassword: options?.databasePassword,
-			dockerImage: options?.dockerImage ?? "redis:8",
-			description: options?.description ?? `Redis instance for ${name}`
-		});
-	}
-	/**
-	* Find or create a Redis instance by name
-	*/
-	async findOrCreateRedis(name, projectId, environmentId, options) {
-		const existing = await this.findRedisByName(projectId, name);
-		if (existing) return {
-			redis: existing,
-			created: false
-		};
-		return {
-			redis: await this.createRedis(name, projectId, environmentId, options),
-			created: true
-		};
-	}
-	/**
-	* Get a Redis instance by ID
-	*/
-	async getRedis(redisId) {
-		return this.get(`redis.one?redisId=${redisId}`);
-	}
-	/**
-	* Deploy a Redis instance
-	*/
-	async deployRedis(redisId) {
-		await this.post("redis.deploy", { redisId });
-	}
-	/**
-	* Save environment variables for Redis
-	*/
-	async saveRedisEnv(redisId, env) {
-		await this.post("redis.saveEnvironment", {
-			redisId,
-			env
-		});
-	}
-	/**
-	* Set external port for Redis (for external access)
-	*/
-	async saveRedisExternalPort(redisId, externalPort) {
-		await this.post("redis.saveExternalPort", {
-			redisId,
-			externalPort
-		});
-	}
-	/**
-	* Update Redis configuration
-	*/
-	async updateRedis(redisId, updates) {
-		await this.post("redis.update", {
-			redisId,
-			...updates
-		});
-	}
-	/**
-	* Delete a Redis instance
-	*/
-	async deleteRedis(redisId) {
-		await this.post("redis.remove", { redisId });
-	}
-	/**
-	* Create a new domain for an application
-	*/
-	async createDomain(options) {
-		return this.post("domain.create", options);
-	}
-	/**
-	* Update an existing domain
-	*/
-	async updateDomain(domainId, updates) {
-		await this.post("domain.update", {
-			domainId,
-			...updates
-		});
-	}
-	/**
-	* Delete a domain
-	*/
-	async deleteDomain(domainId) {
-		await this.post("domain.delete", { domainId });
-	}
-	/**
-	* Get a domain by ID
-	*/
-	async getDomain(domainId) {
-		return this.get(`domain.one?domainId=${domainId}`);
-	}
-	/**
-	* Get all domains for an application
-	*/
-	async getDomainsByApplicationId(applicationId) {
-		return this.get(`domain.byApplicationId?applicationId=${applicationId}`);
-	}
-	/**
-	* Validate a domain and trigger SSL certificate generation
-	*
-	* This should be called after DNS records are created and propagated.
-	* It triggers Let's Encrypt certificate generation for HTTPS domains.
-	*
-	* @param domain - The domain hostname to validate (e.g., 'api.example.com')
-	*/
-	async validateDomain(domain) {
-		return this.post("domain.validateDomain", { domain });
+		super(`Failed to build Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerBuildFailed";
 	}
-	/**
-	* Auto-generate a domain name for an application
-	*/
-	async generateDomain(appName, serverId) {
-		return this.post("domain.generateDomain", {
-			appName,
-			serverId
-		});
+};
+/** `docker push` failed — usually the registry login or its permissions. */
+var DockerPushFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to push Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerPushFailed";
 	}
-	/**
-	* List all backup destinations
-	*/
-	async listDestinations() {
-		return this.get("destination.all");
+};
+/** `gkm docker --push` was asked for with nowhere to push to. */
+var PushNeedsRegistry = class extends Error {
+	imageName;
+	constructor(imageName) {
+		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
+		this.imageName = imageName;
+		this.name = "PushNeedsRegistry";
 	}
-	/**
-	* Get a destination by ID
-	*/
-	async getDestination(destinationId) {
-		return this.get(`destination.one?destinationId=${destinationId}`);
+};
+/**
+* Docker command implementation
+* Generates Dockerfile, docker-compose.yml, and related files
+*
+* Default: Multi-stage Dockerfile that builds from source inside Docker
+* --slim: Slim Dockerfile that copies pre-built bundle (requires prior build)
+*/
+async function dockerCommand(options) {
+	const cwd = options.cwd ?? process.cwd();
+	const loadedConfig = await loadWorkspaceConfig(cwd);
+	if (loadedConfig.type === "workspace") {
+		logger.log("📦 Detected workspace configuration");
+		return workspaceDockerCommand(loadedConfig.workspace, loadedConfig.manifest);
 	}
-	/**
-	* Create a new S3 backup destination
-	*/
-	async createDestination(options) {
-		return this.post("destination.create", { ...options });
+	const dockerConfig = resolveDockerConfig(await loadConfig(cwd));
+	const healthCheckPath = "/health";
+	const useSlim = options.slim === true;
+	if (useSlim) {
+		const distDir = join(cwd, ".gkm", "server", "dist");
+		if (!existsSync(join(distDir, "server.mjs"))) throw new Error("Slim Dockerfile requires a pre-built bundle. Run `gkm build --provider server --production` first, or omit --slim to use multi-stage build.");
 	}
-	/**
-	* Find a destination by name
-	*/
-	async findDestinationByName(name) {
-		return (await this.listDestinations()).find((d) => d.name === name);
+	const dockerDir = join(cwd, ".gkm", "docker");
+	await mkdir(dockerDir, { recursive: true });
+	const packageManager = detectPackageManager(cwd);
+	const inMonorepo = isMonorepo(cwd);
+	const hasTurbo = hasTurboConfig(cwd);
+	let useTurbo = options.turbo ?? false;
+	if (inMonorepo && !useSlim) {
+		if (hasTurbo) {
+			useTurbo = true;
+			logger.log("   Detected monorepo with turbo.json - using turbo prune");
+		} else throw new Error("Monorepo detected but turbo.json not found.\n\nDocker builds in monorepos require Turborepo for proper dependency isolation.\n\nTo fix this:\n  1. Install turbo: pnpm add -Dw turbo\n  2. Create turbo.json in your monorepo root\n  3. Run this command again\n\nSee: https://turbo.build/repo/docs/guides/tools/docker");
 	}
-	/**
-	* Find or create a destination by name
-	*/
-	async findOrCreateDestination(name, options) {
-		const existing = await this.findDestinationByName(name);
-		if (existing) return {
-			destination: existing,
-			created: false
-		};
-		return {
-			destination: await this.createDestination({
-				name,
-				...options
-			}),
-			created: true
-		};
+	let turboPackage = options.turboPackage ?? dockerConfig.imageName;
+	if (useTurbo && !options.turboPackage) try {
+		const pkg = __require(`${cwd}/package.json`);
+		if (pkg.name) {
+			turboPackage = pkg.name;
+			logger.log(`   Turbo package: ${turboPackage}`);
+		}
+	} catch {}
+	const templateOptions = {
+		imageName: dockerConfig.imageName,
+		baseImage: dockerConfig.baseImage,
+		port: dockerConfig.port,
+		healthCheckPath,
+		prebuilt: useSlim,
+		turbo: useTurbo,
+		turboPackage,
+		packageManager
+	};
+	const dockerfile = useSlim ? generateSlimDockerfile(templateOptions) : generateMultiStageDockerfile(templateOptions);
+	const dockerMode = useSlim ? "slim" : useTurbo ? "turbo" : "multi-stage";
+	const dockerfilePath = join(dockerDir, "Dockerfile");
+	await writeFile(dockerfilePath, dockerfile);
+	logger.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
+	const composePath = await writeConstructsCompose(loadedConfig.workspace);
+	const dockerignore = generateDockerignore();
+	const dockerignorePath = join(cwd, ".dockerignore");
+	await writeFile(dockerignorePath, dockerignore);
+	logger.log("Generated: .dockerignore (project root)");
+	const entrypoint = generateDockerEntrypoint();
+	const entrypointPath = join(dockerDir, "docker-entrypoint.sh");
+	await writeFile(entrypointPath, entrypoint);
+	logger.log("Generated: .gkm/docker/docker-entrypoint.sh");
+	const result = {
+		dockerfile: dockerfilePath,
+		dockerCompose: composePath,
+		dockerignore: dockerignorePath,
+		entrypoint: entrypointPath
+	};
+	if (options.build) await buildDockerImage(dockerConfig.imageName, options, cwd);
+	if (options.push) await pushDockerImage(dockerConfig.imageName, options, cwd);
+	return result;
+}
+/**
+* Ensure lockfile exists in the build context
+* For monorepos, copies from workspace root if needed
+* Returns cleanup function if file was copied
+*/
+function ensureLockfile(cwd) {
+	const lockfilePath = findLockfilePath(cwd);
+	if (!lockfilePath) {
+		logger.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
+		return null;
 	}
-	/**
-	* Update a destination
-	*/
-	async updateDestination(destinationId, updates) {
-		await this.post("destination.update", {
-			destinationId,
-			...updates
+	const lockfileName = basename(lockfilePath);
+	const localLockfile = join(cwd, lockfileName);
+	if (lockfilePath === localLockfile) return null;
+	logger.log(`   Copying ${lockfileName} from monorepo root...`);
+	copyFileSync(lockfilePath, localLockfile);
+	return () => {
+		try {
+			unlinkSync(localLockfile);
+		} catch {}
+	};
+}
+/**
+* Build Docker image
+* Uses BuildKit for cache mount support
+*/
+async function buildDockerImage(imageName, options, cwd) {
+	const tag = options.tag ?? "latest";
+	const registry = options.registry;
+	const fullImageName = validateImageRef(registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`);
+	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	const cleanup = ensureLockfile(cwd);
+	try {
+		await run$1("docker", [
+			"build",
+			"--file=.gkm/docker/Dockerfile",
+			`--tag=${fullImageName}`,
+			"."
+		], {
+			cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			}
 		});
+		logger.log(`✅ Docker image built: ${fullImageName}`);
+	} catch (error) {
+		throw new DockerBuildFailed(fullImageName, error);
+	} finally {
+		cleanup?.();
 	}
-	/**
-	* Delete a destination
-	*/
-	async deleteDestination(destinationId) {
-		await this.post("destination.remove", { destinationId });
+}
+/**
+* Push Docker image to registry
+*/
+async function pushDockerImage(imageName, options, cwd) {
+	const tag = options.tag ?? "latest";
+	const registry = options.registry;
+	if (!registry) throw new PushNeedsRegistry(imageName);
+	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
+	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	try {
+		await run$1("docker", ["push", fullImageName], { cwd });
+		logger.log(`✅ Docker image pushed: ${fullImageName}`);
+	} catch (error) {
+		throw new DockerPushFailed(fullImageName, error);
 	}
-	/**
-	* Test connection to a destination
-	*/
-	async testDestinationConnection(destinationId) {
-		return this.post("destination.testConnection", { destinationId });
+}
+/**
+* Get the package name from package.json in an app directory.
+*/
+function getAppPackageName(appPath) {
+	try {
+		const pkgPath = join(appPath, "package.json");
+		if (!existsSync(pkgPath)) return;
+		const content = readFileSync(pkgPath, "utf-8");
+		return JSON.parse(content).name;
+	} catch {
+		return;
 	}
-	/**
-	* Create a backup schedule for postgres
-	*/
-	async createPostgresBackup(options) {
-		return this.post("backup.create", {
-			...options,
-			databaseType: "postgres"
+}
+/**
+* Generate Dockerfiles for all apps in a workspace.
+* @internal Exported for testing
+*/
+async function workspaceDockerCommand(workspace, manifest) {
+	const results = [];
+	const apps = Object.entries(workspace.apps);
+	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	const dockerDir = join(workspace.root, ".gkm", "docker");
+	await mkdir(dockerDir, { recursive: true });
+	const packageManager = detectPackageManager(workspace.root);
+	logger.log(`   Package manager: ${packageManager}`);
+	for (const [appName, app] of apps) {
+		if (app.type === "mobile") {
+			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			continue;
+		}
+		const appPath = app.path;
+		const turboPackage = getAppPackageName(join(workspace.root, appPath)) ?? appName;
+		const imageName = appName;
+		const buildType = !!app.entry ? "entry" : app.type;
+		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		let dockerfile;
+		if (app.type === "web") dockerfile = siteDockerfile(appName, app, {
+			turboPackage,
+			packageManager,
+			...manifest ? { manifest } : {}
 		});
-	}
-	/**
-	* List backups for a postgres database
-	*/
-	async listPostgresBackups(postgresId) {
-		return this.get(`backup.all?postgresId=${postgresId}&databaseType=postgres`);
-	}
-	/**
-	* Get a backup by ID
-	*/
-	async getBackup(backupId) {
-		return this.get(`backup.one?backupId=${backupId}`);
-	}
-	/**
-	* Update a backup schedule
-	*/
-	async updateBackup(backupId, updates) {
-		await this.post("backup.update", {
-			backupId,
-			...updates
+		else if (app.entry) dockerfile = generateEntryDockerfile({
+			imageName,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			appPath,
+			entry: app.entry,
+			turboPackage,
+			packageManager,
+			healthCheckPath: "/health"
+		});
+		else dockerfile = generateBackendDockerfile({
+			imageName,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			appPath,
+			turboPackage,
+			packageManager,
+			healthCheckPath: "/health"
+		});
+		const dockerfilePath = join(dockerDir, `Dockerfile.${appName}`);
+		await writeFile(dockerfilePath, dockerfile);
+		logger.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
+		results.push({
+			appName,
+			type: app.type,
+			dockerfile: dockerfilePath,
+			imageName
 		});
 	}
-	/**
-	* Delete a backup schedule
-	*/
-	async deleteBackup(backupId) {
-		await this.post("backup.remove", { backupId });
-	}
-	/**
-	* Trigger a manual backup run
-	*/
-	async runBackupManually(backupId) {
-		await this.post("backup.manualBackup", { backupId });
+	const dockerignore = generateDockerignore();
+	const dockerignorePath = join(workspace.root, ".dockerignore");
+	await writeFile(dockerignorePath, dockerignore);
+	logger.log(`\n   Generated: .dockerignore (workspace root)`);
+	const composePath = await writeConstructsCompose(workspace);
+	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger.log("\n📋 Build commands:");
+	for (const result of results) {
+		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
+		logger.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
 	}
-};
-//#endregion
-//#region src/deploy/sniffer.ts
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
+	printRunInstructions(workspace);
+	return {
+		apps: results,
+		dockerCompose: composePath,
+		dockerignore: dockerignorePath
+	};
+}
 /**
-* Resolve the path to a sniffer helper file.
-* Handles both dev (.ts with tsx) and production (.mjs from dist).
-*
-* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
-* files are output to dist/deploy/ as standalone modules for subprocess loading.
+* A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
-* In development: All files are in src/deploy/ and loaded via tsx.
+* The keys come from the site's declaration where there is one — every
+* public key its edges give it, `VITE_UPLOADS_SERVER_URL` included — and an
+* `ARG` the Dockerfile does not declare is a build argument the build drops,
+* leaving the bundle with an empty URL.
 */
-function resolveSnifferFile(baseName) {
-	const deployMjsPath = resolve(__dirname, "deploy", `${baseName}.mjs`);
-	if (existsSync(deployMjsPath)) return deployMjsPath;
-	const mjsPath = resolve(__dirname, `${baseName}.mjs`);
-	if (existsSync(mjsPath)) return mjsPath;
-	const tsPath = resolve(__dirname, `${baseName}.ts`);
-	if (existsSync(tsPath)) return tsPath;
-	return tsPath;
+function siteDockerfile(appName, app, options) {
+	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && appKey(id) === appName)?.[1] : void 0;
+	const publicUrlArgs = declared?.kind === "site" && options.manifest ? Object.keys(publicEnvFor(declared, options.manifest)) : getPublicUrlArgNames(app);
+	const webOpts = {
+		imageName: appName,
+		baseImage: "node:22-alpine",
+		port: app.port,
+		appPath: app.path,
+		turboPackage: options.turboPackage,
+		packageManager: options.packageManager,
+		publicUrlArgs
+	};
+	switch (app.framework) {
+		case "vite": return generateViteStaticDockerfile(webOpts);
+		case "tanstack-start":
+		case "remix": return generateNodeWebDockerfile(webOpts);
+		default: return generateNextjsDockerfile(webOpts);
+	}
 }
 /**
-* Run a sniffer worker in the sandbox, with the sandbox's environment and
-* nothing of the deploy's: the deploy's Dokploy token, registry login and AWS
-* keys stay where they are. A worker that outlives the timeout is killed, and
-* comes back as the error the caller reports.
+* The package name turbo prunes an app by: its package.json's, or its name.
 */
-async function runSniffer(run, workspacePath, cwd, nodeArgs) {
-	const sandbox = run.sandbox ?? activeSandbox() ?? new LocalSandbox({ root: resolve(workspacePath) });
-	try {
-		const result = await sandbox.exec("node", nodeArgs, {
-			cwd,
-			env: { ...sandbox.env },
-			timeoutMs: run.timeoutMs ?? 3e4,
-			output: "capture"
-		});
-		return {
-			stdout: result.stdout,
-			stderr: result.stderr,
-			code: result.exitCode
-		};
-	} catch (error) {
-		return { error: error instanceof Error ? error : new Error(String(error)) };
-	}
-}
-/** The worker's JSON answer: the last object on stdout naming `envVars`. */
-function snifferAnswer(stdout) {
-	try {
-		const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-		return jsonMatch ? JSON.parse(jsonMatch[0]) : void 0;
-	} catch {
-		return;
-	}
+function appPackageName(root, appName, path) {
+	return getAppPackageName(join(root, path)) ?? appName;
 }
 /**
-* Get required environment variables for an app.
+* Write `docker-compose.constructs.yml` — the same file `gkm dev` writes, with
+* the apps beside the containers their constructs derive.
 *
-* Detection strategy (in order):
-* 1. Frontend apps: Returns empty (no server secrets)
-* 2. Apps with `requiredEnv`: Uses explicit list from config
-* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
-* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
-* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
-* 6. Apps with neither: Returns empty
+* Through reconcile rather than a second generator, so what `gkm docker`
+* describes and what `gkm dev` runs cannot disagree. Nothing is started.
+*/
+async function writeConstructsCompose(workspace) {
+	await reconcileWorkspace(workspace, {
+		stage: workspace.stages.local,
+		start: false
+	});
+	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	return join(workspace.root, COMPOSE_PATH);
+}
+function printRunInstructions(workspace) {
+	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
+	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger.log("   gkm setup   # starts the containers and creates what they hold");
+	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
+}
+//#endregion
+//#region src/deploy/generated.ts
+/**
+* The values a deployed stage generates once and keeps: what nothing can
+* provision and nobody else issues.
 *
-* This function handles "fire and forget" async operations gracefully,
-* capturing errors and unhandled rejections without failing the build.
+* - **A seed**, which salts every password a deploy derives — a database's
+*   master and roles, a bucket's root user. Derived from repo facts alone
+*   (project, stage, construct id), those passwords were computable by anyone
+*   who could read the repo.
+* - **Each `secret` construct's value** — an auth server's signing secret —
+*   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
-* @param app - The normalized app configuration
-* @param appName - The name of the app
-* @param workspacePath - Absolute path to the workspace root
-* @param options - Optional configuration for sniffing behavior
-* @returns The sniffed environment with required variables
+* Both are generated on the first deploy that needs them and written to the
+* stage's store, so every later deploy reads the same values: sessions survive
+* a redeploy, and a role's password does not move. A value set by hand with
+* `gkm secrets:set` is kept, never replaced.
+*/
+/**
+* The stage's secrets with its seed and every declared `secret`'s value
+* present, generating what is missing. Pure: the caller writes the result
+* back to the stage's store when `generated` is not empty.
 */
-async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
-	const { logWarnings = true, markOptional = false } = options;
-	const run = {
-		...options.sandbox ? { sandbox: options.sandbox } : {},
-		...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}
+function withGeneratedSecrets(secrets, manifest) {
+	const generated = [];
+	const custom = { ...secrets.custom };
+	for (const declaration of Object.values(manifest)) {
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
+		const key = declaration.provides?.[0];
+		if (!key || custom[key]) continue;
+		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
+		generated.push(key);
+	}
+	const seed = secrets.seed ?? random();
+	if (!secrets.seed) generated.push("seed");
+	return {
+		secrets: generated.length ? {
+			...secrets,
+			seed,
+			custom,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : secrets,
+		generated
 	};
-	if (app.type === "web" || app.type === "mobile") {
-		const publicPrefix = getPublicEnvPrefix(app.framework);
-		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
-		if (app.config) {
-			const sniffedVars = [];
-			const sniffedOptional = [];
-			const configPaths = [];
-			if (app.config.client) configPaths.push(app.config.client);
-			if (app.config.server) configPaths.push(app.config.server);
-			for (const configPath of configPaths) {
-				const result = await sniffEntryFile(configPath, app.path, workspacePath, run);
-				if (logWarnings && result.error) output.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
-				sniffedVars.push(...result.envVars);
-				sniffedOptional.push(...result.optionalEnvVars);
+}
+/** 256 bits, URL-safe. */
+function random() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
+	stage;
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
+		this.stage = stage;
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	/**
+	* The stage's journal — its stored state, or `initial` written as the
+	* stage's first state, so there is somewhere to record the very first
+	* resource before it is created.
+	*/
+	static async open(store, stage, initial) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
+		});
+	}
+	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
+		});
+	}
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
 			}
-			const optionalEnvVars = [...new Set(sniffedOptional)];
+			staleId = record.id;
+		}
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
 			return {
-				appName,
-				requiredEnvVars: applyMarkOptional([.../* @__PURE__ */ new Set([...depVars, ...sniffedVars])], optionalEnvVars, markOptional),
-				optionalEnvVars
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
 			};
 		}
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
 		return {
-			appName,
-			requiredEnvVars: depVars,
-			optionalEnvVars: []
-		};
-	}
-	if (app.entry) {
-		const result = await sniffEntryFile(app.entry, app.path, workspacePath, run);
-		if (logWarnings && result.error) output.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
-		return {
-			appName,
-			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
-			optionalEnvVars: result.optionalEnvVars
-		};
-	}
-	if (app.routes) {
-		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath, run);
-		if (logWarnings && result.error) output.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
-		return {
-			appName,
-			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
-			optionalEnvVars: result.optionalEnvVars
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
 		};
 	}
-	if (app.envParser) {
-		const result = await sniffEnvParser(app.envParser, app.path, workspacePath, run);
-		if (logWarnings) {
-			if (result.error) output.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
-			if (result.unhandledRejections.length > 0) output.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
-		}
-		return {
-			appName,
-			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
-			optionalEnvVars: result.optionalEnvVars
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
 		};
 	}
+};
+//#endregion
+//#region src/deploy/state.ts
+/**
+* Create a new empty state for a stage
+*/
+function createEmptyState(stage, projectId, environmentId) {
 	return {
-		appName,
-		requiredEnvVars: [],
-		optionalEnvVars: []
+		provider: "dokploy",
+		stage,
+		projectId,
+		environmentId,
+		applications: {},
+		services: {},
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
 /**
-* Apply the `?` suffix to optional variables in an env var list.
-* Only modifies the list when `markOptional` is true and there are optional vars.
+* Set application ID in state (mutates state)
 */
-function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
-	if (!markOptional || optionalEnvVars.length === 0) return envVars;
-	const optionalSet = new Set(optionalEnvVars);
-	return envVars.map((v) => optionalSet.has(v) ? `${v}?` : v);
+function setApplicationId(state, appName, applicationId) {
+	state.applications[appName] = applicationId;
+}
+/** Two records naming the same image: by digest when both have one. */
+function sameImage(a, b) {
+	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
+}
+/** The newest release in `history` after `index` that a rollback may restore. */
+function restorable(history, index, current) {
+	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
 }
 /**
-* Sniff an entry file by importing it in a subprocess.
-*
-* Entry apps call `config.parse()` at module load time. To capture which
-* env vars are accessed, we:
-* 1. Spawn a subprocess with a module loader hook
-* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
-*    with SnifferEnvironmentParser
-* 3. Import the entry file (triggers config.parse())
-* 4. Capture and return the accessed env var names
-*
-* This approach provides process isolation - each app is sniffed in its own
-* subprocess, preventing module cache pollution.
-*
-* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
-* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
-* @param workspacePath - Absolute path to workspace root
-* @returns EntrySniffResult with env vars and optional error
+* Record that `image` went live for `appName` (mutates state): it becomes
+* `current`, and what was current becomes `previous`. Releasing what already
+* runs — a redeploy of the same digest — changes nothing.
 */
-async function sniffEntryFile(entryPath, appPath, workspacePath, run = {}) {
-	const fullEntryPath = resolve(workspacePath, appPath, entryPath);
-	const loaderPath = resolveSnifferFile("sniffer-loader");
-	const workerPath = resolveSnifferFile("sniffer-worker");
-	const ran = await runSniffer(run, workspacePath, resolve(workspacePath, appPath), nodeWithTsx(workerPath, [fullEntryPath], [loaderPath]));
-	if ("error" in ran) return {
-		envVars: [],
-		optionalEnvVars: [],
-		error: ran.error
+function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+	const releases = state.releases?.[appName];
+	if (releases && sameImage(releases.current, image)) return;
+	const entry = {
+		...image,
+		releasedAt: releasedAt.toISOString()
 	};
-	const answer = snifferAnswer(ran.stdout);
-	if (answer) return {
-		envVars: answer.envVars || [],
-		optionalEnvVars: answer.optionalEnvVars || [],
-		error: answer.error ? new Error(answer.error) : void 0
+	const history = [entry, ...releases?.history ?? []].slice(0, 10);
+	const previous = releases?.current;
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current: entry,
+			...previous ? { previous } : {},
+			history
+		}
 	};
-	return {
-		envVars: [],
-		optionalEnvVars: [],
-		error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+}
+/**
+* Record that `appName` was rolled back to `to` (mutates state): every
+* release newer than it is marked rolled back, so neither this rollback nor
+* a later one restores it, and `previous` moves to the release before `to`.
+*/
+function recordRollback(state, appName, to) {
+	const releases = state.releases?.[appName];
+	if (!releases) return;
+	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
+	if (index === -1) return;
+	const history = releases.history.map((entry, i) => i < index ? {
+		...entry,
+		rolledBack: true
+	} : entry);
+	const current = history[index];
+	const previous = restorable(history, index, current);
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current,
+			...previous ? { previous } : {},
+			history
+		}
 	};
 }
 /**
-* Sniff route files by loading constructs and calling getEnvironment().
-*
-* Route-based apps have endpoints, functions, crons, and subscribers that
-* use services. Each service's register() method accesses environment variables.
-*
-* This runs in a subprocess with tsx loader to properly handle TypeScript
-* compilation and path alias resolution (e.g., `src/...` imports).
-*
-* @param routes - Glob pattern(s) for route files
-* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
-* @param workspacePath - Absolute path to workspace root
-* @returns EntrySniffResult with env vars and optional error
+* Get a generated secret for an app
 */
-async function sniffRouteFiles(routes, appPath, workspacePath, run = {}) {
-	const fullAppPath = resolve(workspacePath, appPath);
-	const workerPath = resolveSnifferFile("sniffer-routes-worker");
-	const pattern = (Array.isArray(routes) ? routes : [routes])[0];
-	if (!pattern) return {
-		envVars: [],
-		optionalEnvVars: [],
-		error: /* @__PURE__ */ new Error("No route patterns provided")
-	};
-	const ran = await runSniffer(run, workspacePath, fullAppPath, nodeWithTsx(workerPath, [fullAppPath, pattern]));
-	if ("error" in ran) return {
-		envVars: [],
-		optionalEnvVars: [],
-		error: ran.error
-	};
-	if (ran.stderr) ran.stderr.split("\n").filter((line) => line.trim()).forEach((line) => output.warn(line));
-	const answer = snifferAnswer(ran.stdout);
-	if (answer) return {
-		envVars: answer.envVars || [],
-		optionalEnvVars: answer.optionalEnvVars || [],
-		error: answer.error ? new Error(answer.error) : void 0
-	};
-	return {
-		envVars: [],
-		optionalEnvVars: [],
-		error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
-	};
+function getGeneratedSecret(state, appName, secretName) {
+	return state?.generatedSecrets?.[appName]?.[secretName];
 }
 /**
-* Run the SnifferEnvironmentParser on an envParser module to detect
-* which environment variables it accesses.
-*
-* In a subprocess, like the entry and route sniffers: the module is the
-* project's code, and it was imported into the deploy itself before — with
-* every credential the deploy held in reach. Fire-and-forget rejections are
-* collected there with the shared `sniffWithFireAndForget`.
-*
-* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
-* @param appPath - The app's path relative to workspace
-* @param workspacePath - Absolute path to workspace root
-* @returns SniffResult with env vars and any errors encountered
+* Set a generated secret for an app (mutates state)
 */
-async function sniffEnvParser(envParserPath, appPath, workspacePath, run = {}) {
-	const [modulePath, exportName = "default"] = envParserPath.split("#");
-	if (!modulePath) return {
-		envVars: [],
-		optionalEnvVars: [],
-		unhandledRejections: []
-	};
-	const appRoot = resolve(workspacePath, appPath);
-	const fullPath = resolve(appRoot, modulePath);
-	const workerPath = resolveSnifferFile("sniffer-envparser-worker");
-	const ran = await runSniffer(run, workspacePath, appRoot, nodeWithTsx(workerPath, [fullPath, exportName]));
-	if ("error" in ran) return {
-		envVars: [],
-		optionalEnvVars: [],
-		unhandledRejections: [],
-		error: ran.error
-	};
-	const answer = snifferAnswer(ran.stdout);
-	if (!answer) return {
-		envVars: [],
-		optionalEnvVars: [],
-		unhandledRejections: [],
-		error: /* @__PURE__ */ new Error(`Failed to sniff envParser (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+function setGeneratedSecret(state, appName, secretName, value) {
+	if (!state.generatedSecrets) state.generatedSecrets = {};
+	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
+	state.generatedSecrets[appName][secretName] = value;
+}
+/**
+* Set DNS verification record for a hostname (mutates state)
+*/
+function setDnsVerification(state, hostname, serverIp) {
+	if (!state.dnsVerified) state.dnsVerified = {};
+	state.dnsVerified[hostname] = {
+		serverIp,
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
-	for (const warning of answer.warnings ?? []) output.warn(warning);
-	return {
-		envVars: answer.envVars ?? [],
-		optionalEnvVars: answer.optionalEnvVars ?? [],
-		unhandledRejections: (answer.unhandledRejections ?? []).map((message) => new Error(message)),
-		...answer.error ? { error: new Error(answer.error) } : {}
+}
+/**
+* Check if a hostname is already verified with the given IP
+*/
+function isDnsVerified(state, hostname, serverIp) {
+	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
+}
+/**
+* Get the key for a DNS record in state
+*/
+function getDnsRecordKey(name, type) {
+	return `${name}:${type}`;
+}
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
 /**
-* Sniff environment requirements for multiple apps.
-*
-* @param apps - Map of app name to app config
-* @param workspacePath - Absolute path to workspace root
-* @param options - Optional configuration for sniffing behavior
-* @returns Map of app name to sniffed environment
+* Get backup state from state
 */
-async function sniffAllApps(apps, workspacePath, options = {}) {
-	const results = /* @__PURE__ */ new Map();
-	for (const [appName, app] of Object.entries(apps)) {
-		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
-		results.set(appName, sniffed);
-	}
-	return results;
+function getBackupState(state) {
+	return state?.backups;
+}
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
+}
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { pgClient as $, StateStoreBusy as A, FAKE_ENV as B, setDnsRecord as C, loginCommand as Ct, DocumentStateStore as D, canPrompt as Dt, setPostgresBackupId as E, whoamiCommand as Et, newLockHolder as F, workspace_exports as G, constructGlobs as H, withGeneratedSecrets as I, applyPostgres as J, LOCAL_CA_PATH as K, encryptSecrets as L, StateVersionConflict as M, contentVersion as N, StageStateMissing as O, prompt as Ot, createStateStore as P, composeFor as Q, encryption_exports as R, setDeployedImage as S, prepareEntryCredentials as St, setGeneratedSecret as T, validateDokployToken as Tt, derivedContainers as U, backendsOf as V, reconcileWorkspace as W, postgresStatements as X, postgresDatabaseNames as Y, quoteIdentifier as Z, getBackupState as _, createEntryWrapper as _t, DockerBuildFailed as a, resourceName as at, setApplicationId as b, loadEnvFiles as bt, dockerCommand as c, eventsBackendFor as ct, generateDockerignore as d, DEFAULT_IMAGES as dt, appEnvKeys as et, generateSlimDockerfile as f, describeServices as ft, createEmptyState as g, createCredentialsPreload as gt, resolveHost as h, primaryPortKey as ht, DokployApiError as i, planFor as it, StateStoreWithoutLocking as j, StateLocked as k, siteDockerfile as l, providerOf as lt, isMainFrontendApp as m, portKeys as mt, sniffAppEnvironment as n, envFor as nt, DockerPushFailed as o, hostFor as ot, validateImageRef as p, fakeKey as pt, forgetState as q, DokployApi as r, localRolePassword as rt, appPackageName as s, cacheBackendFor as st, sniffAllApps as t, networkEnv as tt, detectPackageManager as u, storageBackendFor as ut, getGeneratedSecret as v, findAvailablePort as vt, setDnsVerification as w, logoutCommand as wt, setBackupState as x, loadSecretsForApp as xt, isDnsVerified as y, isPortAvailable as yt, keyFingerprint as z };
+export { describeServices as $, reconcileWorkspace as A, withCustomSecret as At, appEnvKeys as B, validateImageRef as C, markerOf as Ct, backendsOf as D, maskPassword as Dt, FAKE_ENV as E, initStageSecrets as Et, postgresDatabaseNames as F, planFor as G, networkEnv as H, postgresStatements as I, cacheBackendFor as J, resourceName as K, quoteIdentifier as L, LOCAL_CA_PATH as M, forgetState as N, constructGlobs as O, storage_exports as Ot, applyPostgres as P, DEFAULT_IMAGES as Q, composeFor as R, generateSlimDockerfile as S, isOwnedBy as St, resolveHost as T, projectName as Tt, envFor as U, dockerfileOf as V, localRolePassword as W, providerOf as X, eventsBackendFor as Y, storageBackendFor as Z, appPackageName as _, readKey as _t, recordRelease as a, findAvailablePort as at, detectPackageManager as b, imageName as bt, setBackupState as c, loadSecretsForApp as ct, setGeneratedSecret as d, secretsStoreFor as dt, fakeKey as et, setPostgresBackupId as f, store_exports as ft, DockerPushFailed as g, projectKey as gt, DockerBuildFailed as h, keystoreProject as ht, isDnsVerified as i, createEntryWrapper as it, workspace_exports as j, derivedContainers as k, toEmbeddableSecrets as kt, setDnsRecord as l, prepareEntryCredentials as lt, withGeneratedSecrets as m, getKeyPath as mt, getBackupState as n, primaryPortKey as nt, recordRollback as o, isPortAvailable as ot, DeployJournal as p, FileSecretsStore as pt, hostFor as q, getGeneratedSecret as r, createCredentialsPreload as rt, setApplicationId as s, loadEnvFiles as st, createEmptyState as t, portKeys as tt, setDnsVerification as u, isRemoteStore as ut, dockerCommand as v, applicationName as vt, isMainFrontendApp as w, ownershipMarker as wt, generateDockerignore as x, imageRef as xt, siteDockerfile as y, deployIdentity as yt, pgClient as z };
 
-//# sourceMappingURL=sniffer-49KPbDgq.mjs.map
+//# sourceMappingURL=state-uuYqnRVO.mjs.map