@geekmidas/cli 10.0.0-alpha.1 → 10.0.0-alpha.100

package/dist/engine-32gL2ju3.mjs

@@ -0,0 +1,3082 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
+import { t as MissingCredential } from "./credentials-B5N5yKk6.mjs";
+import { I as otlpTelemetryEnv, L as resolveStageTelemetry, ht as isReservedStageKey, u as getAppBuildOrder, v as getPublicEnvPrefix, y as stripPublicPrefix } from "./workspace-D1QbNd55.mjs";
+import { a as discriminatedUnion, c as literal, d as object, l as looseObject, n as array, p as string } from "./schemas-BCwKKA42.mjs";
+import { $ as devServicesUsed, An as scopeTelemetryEnv, B as workerDockerfileOf, C as setApplicationId, Ct as cacheBackendFor, Dn as resourceName, E as setPostgresBackupId, Et as storageBackendFor, F as DockerPushFailed, Ht as toEmbeddableSecrets, K as validateImageRef, L as dockerCommand, M as stageProviderNotes, Mn as telemetryOf, Nn as usesTelemetry, On as appTelemetry, P as DockerBuildFailed, Qt as workerUnits, S as recordRollback, T as setGeneratedSecret, Tt as providerOf, X as ExternalServicesNotConfigured, Xn as isMainFrontendApp, Z as STORAGE_KEY_PAIR, Zn as resolveHost, b as getGeneratedSecret, ct as workerEnvKeys, dt as constructGlobs, et as externalServices, g as asDokployState, gn as withGeneratedSecrets, h as verifyDnsRecords, m as orchestrateDns, n as reportDatabaseRuns, ot as dockerfileOf, qt as WORKER_PORT, r as reportPlannedSeeds, rt as stageServiceDeclarations, s as currentActor, t as DeploySeedsFailed, tn as applyPostgres, u as DeployJournal, v as createEmptyState, w as setBackupState, wt as eventsBackendFor, x as recordRelease, y as getBackupState, zt as initStageSecrets } from "./seeds-E4nUeXTl.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { a as imageRef, c as ownershipMarker, i as imageName, l as projectName, o as isOwnedBy, s as markerOf, t as applicationName } from "./identity-CBXr4wNi.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-kziEht4W.mjs";
+import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
+import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
+import { D as encryptSecrets, E as eventError, g as StateVersionConflict, k as keyFingerprint, m as StateStoreBusy, o as DokployApi, s as DokployApiError, t as sniffAllApps } from "./sniffer-bUiSXLMj.mjs";
+import { _ as migrationFiles, f as plannedSeeds } from "./databases-BeGP5eDh.mjs";
+import { join, relative } from "node:path";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { createHash, randomBytes } from "node:crypto";
+import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
+import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
+import { cacheTableStatements } from "@geekmidas/cache/postgres";
+import { Client } from "pg";
+//#region src/deploy/docker.ts
+const logger$2 = output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* The build arg that names which credentials an image embeds: a hash of the
+* ciphertext, which is not a secret. A BuildKit secret is no part of the
+* build cache's key, so without it a rebuild with credentials encrypted under
+* a new key would reuse the layer that embedded the old ones.
+*/
+function credentialsBuildArg(credentials) {
+	return `GKM_CIPHERTEXT_HASH=${createHash("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
+}
+/** The secret file's content: ciphertext, then IV, one per line. */
+function credentialsFileContent(credentials) {
+	return `${credentials.encrypted}\n${credentials.iv}\n`;
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
+	const path = join(dir, CREDENTIALS_SECRET_ID);
+	await writeFile(path, credentialsFileContent(credentials), { mode: 384 });
+	await chmod(path, 384);
+	return {
+		path,
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio, stage }) {
+	logger$2.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$2.log("   Generating Dockerfile...");
+	const { buildRoot } = await dockerCommand({
+		cwd,
+		...stage ? { stage } : {}
+	});
+	const dockerfilePath = relative(buildRoot, dockerfile);
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
+			credentialsFile: secret?.path
+		}), {
+			cwd: buildRoot,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$2.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$2.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$2.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: join(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {},
+		stage
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$2.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$2.log("\n✅ Docker deployment ready!");
+	logger$2.log(`\n📋 Deployment details:`);
+	logger$2.log(`   Image: ${imageRef}`);
+	logger$2.log(`   Stage: ${stage}`);
+	if (masterKey) logger$2.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
+//#region src/deploy/ownership.ts
+/**
+* Which Dokploy project a deploy is allowed to deploy into.
+*
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
+*/
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends GkmError {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The project this identity owns, if there is one — read only, so a dry run
+* asks the same question a deploy does:
+*
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project.
+* 2. One with this name *and* this identity's marker.
+*
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
+*/
+async function findProject(api, identity, stateProjectId) {
+	const name = projectName(identity);
+	const marker = ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				description: known.description ?? null,
+				environments: known.environments ?? [],
+				via: "state",
+				needsClaim: !claimed
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			description: owned.description ?? null,
+			environments: details.environments ?? [],
+			via: "marker",
+			needsClaim: false
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	return null;
+}
+/**
+* The project this deploy deploys into: the one {@link findProject} finds —
+* claimed with this identity's marker if it carries none yet, so the next
+* deploy without state still finds it — or a new one, marked.
+*/
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const marker = ownershipMarker(identity);
+	const found = await findProject(api, identity, stateProjectId);
+	if (found) {
+		if (found.needsClaim) {
+			await api.updateProject(found.projectId, {
+				name: found.name,
+				description: withMarker(found.description, marker)
+			});
+			log(`   Claimed project ${found.name} for ${identity.key}`);
+		}
+		return {
+			projectId: found.projectId,
+			name: found.name,
+			environments: found.environments,
+			via: found.via
+		};
+	}
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(projectName(identity), withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
+}
+//#endregion
+//#region src/deploy/registry.ts
+/**
+* Which Dokploy registry a stage's images are pulled through.
+*
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
+*/
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends GkmError {
+	stage;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		this.stage = stage;
+		this.name = "RegistryNotConfigured";
+	}
+};
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends GkmError {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
+	}
+};
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends GkmError {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
+	}
+};
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
+	}
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
+//#region src/deploy/secrets.ts
+/**
+* Filter secrets to only include the env vars that an app requires.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Filtered secrets with found/missing tracking
+*/
+function filterSecretsForApp(stageSecrets, sniffedEnv) {
+	const allSecrets = toEmbeddableSecrets(stageSecrets);
+	const filtered = {};
+	const found = [];
+	const missing = [];
+	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
+		filtered[key] = allSecrets[key];
+		found.push(key);
+	} else missing.push(key);
+	return {
+		appName: sniffedEnv.appName,
+		secrets: filtered,
+		found: found.sort(),
+		missing: missing.sort()
+	};
+}
+/**
+* Encrypt filtered secrets for an app.
+* Generates an ephemeral master key that should be injected into Dokploy.
+*
+* @param filteredSecrets - The filtered secrets for the app
+* @returns Encrypted payload with master key
+*/
+function encryptSecretsForApp(filteredSecrets) {
+	const payload = encryptSecrets(filteredSecrets.secrets);
+	return {
+		appName: filteredSecrets.appName,
+		payload,
+		masterKey: payload.masterKey,
+		secretCount: Object.keys(filteredSecrets.secrets).length,
+		missingSecrets: filteredSecrets.missing
+	};
+}
+/**
+* Filter and encrypt secrets for an app in one step.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Encrypted secrets with master key
+*/
+function prepareSecretsForApp(stageSecrets, sniffedEnv) {
+	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+}
+/**
+* Prepare secrets for multiple apps.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedApps - Map of app name to sniffed environment
+* @returns Map of app name to encrypted secrets
+*/
+function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
+		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
+		results.set(appName, encrypted);
+	}
+	return results;
+}
+/**
+* Generate a report on secrets preparation.
+*/
+function generateSecretsReport(encryptedApps, sniffedApps) {
+	const appsWithSecrets = [];
+	const appsWithoutSecrets = [];
+	const appsWithMissingSecrets = [];
+	for (const [appName, sniffedEnv] of sniffedApps) {
+		if (sniffedEnv.requiredEnvVars.length === 0) {
+			appsWithoutSecrets.push(appName);
+			continue;
+		}
+		const encrypted = encryptedApps.get(appName);
+		if (encrypted) {
+			appsWithSecrets.push(appName);
+			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
+				appName,
+				missing: encrypted.missingSecrets
+			});
+		}
+	}
+	return {
+		totalApps: sniffedApps.size,
+		appsWithSecrets: appsWithSecrets.sort(),
+		appsWithoutSecrets: appsWithoutSecrets.sort(),
+		appsWithMissingSecrets
+	};
+}
+//#endregion
+//#region src/target/dokploy/fromManifest.ts
+/**
+* The Dokploy target, read off the construct manifest.
+*
+* The AWS target has done this since `fromManifest` landed: a table keyed by
+* declaration kind, each entry turning one declaration into infrastructure and
+* the env keys it resolves. Dokploy had no such thing — it resolved environment
+* from the *sniffer*, which walks application code for `get('X')` calls, and a
+* construct reads its own key inside `@geekmidas/constructs` where there is
+* nothing to find. So a declared app deployed here got none of the model, and
+* nothing reported the absence: the deploy succeeded and the first request that
+* needed a URL failed at runtime.
+*
+* This is the same table, over the REST wrapper instead of over Pulumi.
+*
+* **Two phases, and the split is not incidental.** Creating a Postgres and
+* creating a role inside it are different kinds of act: the first is an API
+* call, the second needs a connection to a database that does not exist yet
+* when the call is made. So provisioners *accumulate* DDL rather than running
+* it, and it is applied once against a cluster that is up — which is exactly
+* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+*
+* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
+* the same generators the local target and the AWS target use. Dokploy used to
+* write its own `DO $$` block, which meant three targets applying three
+* different definitions of "the role split" and no way to notice they had
+* drifted.
+*
+* Entries are deliberately small and free of I/O ordering: each takes what it
+* needs and returns what it resolved. That is what would let a Pulumi dynamic
+* provider wrap one later without the table itself changing — see §6b.
+*/
+/**
+* The internal hostname a Dokploy Postgres answers on.
+*
+* Its own service name on the Docker network — not the server's public address.
+* An app reaching its database over the public internet would be a credential
+* crossing a network that did not need to see it.
+*/
+function clusterHost(postgres) {
+	return postgres.appName;
+}
+/**
+* What a resource is called in the provider.
+*
+* `cloudName` and nothing else — the same scoped kebab rule the AWS target
+* uses, so a name reads identically on both: `production-shop-orders`.
+*
+* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
+* is one flat list where an application and its database would collide. It is
+* not: `project.one` returns typed collections — `applications`, `postgres`,
+* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
+* the shape of the response and an application and a Postgres of the same name
+* are different objects with different ids. The suffix was answering a question
+* nobody had asked.
+*/
+function serviceName(scope, id) {
+	return cloudName(scope, id);
+}
+const PROVISIONERS = {
+	/**
+	* A Postgres service, plus the roles that reach it.
+	*
+	* The service is `findOrCreate`, because a deploy that recreated the
+	* database would be a deploy that lost the data. The roles are deferred:
+	* they need a connection to a cluster this call has only just asked for.
+	*/
+	database: async (declaration, context) => {
+		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
+		const name = resourceName(declaration.id, declaration.kind, context.stage);
+		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id), context.projectId, context.environmentId, {
+			databaseName: name,
+			databasePassword: derivedPassword(context, `${name}:master`)
+		});
+		const host = clusterHost(postgres);
+		context.clusters[postgres.databaseName] = postgres;
+		const schema = declaration.schema ?? "app";
+		const runtime = name;
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: postgres.databaseName,
+			ownsDatabase: true,
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
+		} };
+	},
+	/**
+	* A schema in the parent's database, with its own role and its own URL — so
+	* the parent's role holds no grant on these tables at all.
+	*/
+	"database-schema": async (declaration, context) => {
+		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const runtime = resourceName(declaration.id, declaration.kind, context.stage);
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: parentUrl.pathname.slice(1),
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema: declaration.schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
+		} };
+	},
+	/**
+	* A read-only endpoint on the same cluster.
+	*
+	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
+	* resolves to the writer's address — and that is safe rather than a
+	* loophole, because read-only is enforced by the reader role's grants and
+	* not by which host the URL names. The role itself was created with its
+	* parent.
+	*/
+	"database-reader": async (declaration, context) => {
+		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		const reader = readerRole(parentUrl.username);
+		return { provides: { [provideKey(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
+	},
+	/**
+	* A cache, wherever the project said it lives.
+	*
+	* `db` is a table in a database the manifest already declares, so it
+	* provisions no service and costs nothing to run — the same relationship
+	* pg-boss has. The table's DDL is deferred with the roles, and the table
+	* name travels in the URL because two caches in one database resolve the
+	* same connection string.
+	*/
+	cache: async (declaration, context) => {
+		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
+		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
+		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
+		const parent = context.provisioned[parentId];
+		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
+		const parentUrl = parent.provides[provideKey(parentId, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
+		const table = declaration.table ?? cacheTable(declaration.id);
+		const schema = schemaOf(context.manifest, parentId);
+		const qualified = schema ? `${schema}.${table}` : table;
+		context.deferred.push(...cacheTableStatements({ table: qualified }).map((statement) => ({
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: statement.describe,
+			sql: statement.sql,
+			...statement.exists ? { exists: statement.exists } : {}
+		})), {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${qualified} is owned by its schema's owner`,
+			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted(ownerRole(new URL(parentUrl).username))}`
+		}, {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
+			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
+		});
+		const url = new URL(parentUrl);
+		url.searchParams.set("table", table);
+		return { provides: { [provideKey(declaration.id, "url")]: url.toString() } };
+	},
+	/**
+	* A bucket: the stage's own, or — allowed — a MinIO stack on the box.
+	*
+	* A deployed stage's bucket is an external one — S3, R2, any S3-compatible
+	* store — whose URL and key pair the stage's secrets hold. Only under
+	* `--allow-dev-services` does this target run MinIO for one, and then
+	* only for a bucket the stage does not account for.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* object storage, so MinIO is the one kind whose infrastructure this
+	* target *writes* rather than configures — a compose file with one
+	* service in it.
+	*
+	* The service is named `cloudName(...)` like everything else, which is not
+	* cosmetic here: containers on `dokploy-network` resolve each other by
+	* service name, so the name is the address. Calling it `minio` would work
+	* for exactly one project on the box and then collide.
+	*
+	* A stage's own bucket URL may carry a key scoped to that bucket
+	* (`s3://KEY:SECRET@bucket`), which the client signs with; the shared
+	* `AWS_ACCESS_KEY_ID` pair is passed beside it when the stage set one, for
+	* a bucket whose URL has none. The MinIO this provisions uses that pair —
+	* the stage's, or one derived for it.
+	*/
+	objects: async (declaration, context) => {
+		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			...storageKeys(context.supplied)
+		} };
+		const backend = context.storage ?? "minio";
+		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		if (!context.devServices?.includes("minio")) throw notConfigured(declaration.id, "objects", context);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
+		const user = context.supplied?.AWS_ACCESS_KEY_ID ?? `${bucket}-root`;
+		const password = context.supplied?.AWS_SECRET_ACCESS_KEY ?? derivedPassword(context, `objects:${declaration.id}`);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
+			service,
+			bucket,
+			user,
+			password
+		}));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[key]: s3Url(service, bucket),
+			AWS_ACCESS_KEY_ID: user,
+			AWS_SECRET_ACCESS_KEY: password,
+			AWS_REGION: context.supplied?.AWS_REGION ?? MINIO_REGION
+		} };
+	},
+	/**
+	* The address a bucket's objects are served on.
+	*
+	* The stage's own — a CDN, the bucket's domain — when its secrets hold
+	* one, which a bucket that is not MinIO's needs.
+	*
+	* Over MinIO nothing is provisioned: Dokploy runs Traefik, so a second
+	* reverse proxy behind the first would terminate TLS twice — which is why
+	* the local target's Caddy has no equivalent here. What this resolves is
+	* the address, and the `open` prefixes are applied to the bucket rather
+	* than to an edge, so a policy is what makes them public wherever the
+	* bucket lives. Until a Traefik rule exists it answers on MinIO directly,
+	* path-style, which is honest about the shape it has today: the bucket is
+	* in the path rather than fronted by a host of its own.
+	*/
+	"file-server": async (declaration, context) => {
+		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: { [key]: given } };
+		const parentUrl = context.provisioned[declaration.of]?.provides[provideKey(declaration.of, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
+		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
+		const bucket = new URL(parentUrl).hostname;
+		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
+		return { provides: { [key]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* Mail: the stage's own SMTP server, or — allowed — Mailpit on the box.
+	*
+	* Every provider speaks SMTP, so the provider is whatever the stage's
+	* `<ID>_URL` names, with the address it sends from beside it. Only under
+	* `--allow-dev-services`, and only where the stage set no URL, does this
+	* run Mailpit — which catches every message and delivers none.
+	*/
+	email: async (declaration, context) => {
+		if (declaration.kind !== "email") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const from = provideKey(declaration.id, "from");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			[from]: supplied(declaration.id, from, context)
+		} };
+		if (!context.devServices?.includes("mailpit")) throw notConfigured(declaration.id, "email", context);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, mailpitCompose(service));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[key]: `smtp://${service}:1025`,
+			[from]: context.supplied?.[from] ?? `noreply@${context.domain ?? "localhost"}`
+		} };
+	},
+	/**
+	* A topic, and below it a queue — the same broker either way.
+	*
+	* Under pg-boss there is nothing to create in Dokploy: the broker is a
+	* schema tenant of the database the app already declared, exactly as it is
+	* locally, so what this resolves is an address rather than a service. Which
+	* is the point of putting the backend in config — the same handlers drain
+	* pg-boss here and SQS on AWS because the string they were handed said so.
+	*
+	* The tenant gets its own role rather than the cluster master, for the
+	* reason every other tenant does: pg-boss creates and owns its tables, and
+	* a broker that could also read the application's is a broker with a grant
+	* nothing asked for.
+	*/
+	topic: async (declaration, context) => {
+		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	queue: async (declaration, context) => {
+		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	/**
+	* A signing key, generated once and remembered in the stage's store.
+	*
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
+	*/
+	secret: async (declaration, context) => {
+		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
+		const key = declaration.provides?.[0];
+		if (!key) return { provides: {} };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = provideKey(declaration.id, "credentials");
+		return { provides: {
+			[provideKey(declaration.id, "url")]: externalApiUrl(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
+	},
+	/**
+	* A surface, at the address whatever created its domain assigned.
+	*
+	* Nothing is provisioned here: the application and its domain are the
+	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
+	* Encrypt certificate. What this adds is the *derivation* — who may call it,
+	* and where a cookie it sets is readable — from the graph rather than from a
+	* hand-maintained list.
+	*/
+	"rest-api": async (declaration, context) => {
+		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
+		const url = context.addresses?.[declaration.id];
+		if (!url) throw new SurfaceHasNoAddress(declaration.id);
+		const origins = [...new Set(dependentsOf(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
+		const domain = cookieDomain([url, ...origins]);
+		const schemes = dependentsOf(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? mobileOrigins(schemeBase(context.project, app.scheme)) : [];
+		});
+		return { provides: {
+			[provideKey(declaration.id, "url")]: url,
+			[provideKey(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
+			...domain ? { [provideKey(declaration.id, "cookieDomain")]: domain } : {}
+		} };
+	}
+};
+/** The provisioner for a kind, or nothing where this target has none yet. */
+function provisionerFor(kind) {
+	return PROVISIONERS[kind];
+}
+/**
+* The role DDL for one database or tenant, from the shared generator.
+*
+* The same statements the local target applies and the same ones the AWS
+* bootstrap runs. Dokploy used to write its own, which is how three targets
+* came to hold three definitions of the same split.
+*/
+function statementsFor(options) {
+	const { id, database, runtime, owner, reader, schema, context } = options;
+	return roleStatements({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		...options.ownsDatabase ? { database } : {},
+		passwords: {
+			runtime: derivedPassword(context, runtime),
+			owner: derivedPassword(context, owner),
+			...reader ? { reader: derivedPassword(context, reader) } : {}
+		}
+	}).map((statement) => ({
+		...statement,
+		id,
+		database
+	}));
+}
+/**
+* The connection string a declared queue or topic publishes on.
+*
+* One broker for the whole project, which is what the local target does and
+* what the runtime expects: the generated pollers open a single connection and
+* subscribe each worker by name on it. So every carrier resolves to the same
+* address, and the DDL that backs it is pushed once however many are declared.
+*
+* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
+* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
+* the §4.3 question, and composing a plausible URL for either would fail at the
+* first publish instead of here.
+*/
+function broker(id, context) {
+	const backend = context.events ?? "pgboss";
+	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
+	const parentId = soleDatabase(context);
+	if (!parentId) throw new BrokerNeedsADatabase(id);
+	const parentUrl = context.provisioned[parentId]?.provides[provideKey(parentId, "url")];
+	if (!parentUrl) throw new UnresolvedParent(id, parentId);
+	const url = new URL(parentUrl);
+	const database = url.pathname.slice(1);
+	const runtime = `${database}_${PGBOSS_SCHEMA}`;
+	const owner = ownerRole(runtime);
+	if (!context.provisioned[BROKER_ID]) {
+		context.deferred.push(...statementsFor({
+			id: BROKER_ID,
+			database,
+			runtime,
+			owner,
+			schema: PGBOSS_SCHEMA,
+			context
+		}));
+		context.provisioned[BROKER_ID] = { provides: {} };
+	}
+	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
+	return { provides: { [provideKey(id, "publisherConnectionString")]: connection } };
+}
+/** The schema pg-boss creates its tables in, here as locally. */
+const PGBOSS_SCHEMA = "pgboss";
+/**
+* The id the broker's DDL is pushed under.
+*
+* Not a construct — no declaration names it — but the deferred statements need
+* an id, and every carrier in the project shares this one.
+*/
+const BROKER_ID = "PgBoss";
+/**
+* A pg-boss address: a Postgres URL under a scheme that picks the transport.
+*
+* The protocol is what a producer branches on, so it never branches — the same
+* `.publish()` reaches pg-boss here and SQS on AWS.
+*/
+function pgbossUrl(role, password, host, database) {
+	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
+}
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
+/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
+function s3Url(service, bucket) {
+	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
+}
+/**
+* A one-service compose file for a bucket.
+*
+* `dokploy-network` is external and already exists — it is what every Dokploy
+* service is attached to, and joining it is what makes the app able to resolve
+* this one by name. The bucket itself is created by MinIO's entrypoint rather
+* than by a second call, so there is nothing to reconcile afterwards.
+*/
+function minioCompose(options) {
+	const { service, bucket, user, password } = options;
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+		`    command: server /data --console-address ":9001"`,
+		"    environment:",
+		`      MINIO_ROOT_USER: ${user}`,
+		`      MINIO_ROOT_PASSWORD: ${password}`,
+		"    volumes:",
+		`      - ${service}-data:/data`,
+		"    networks:",
+		"      - dokploy-network",
+		"    healthcheck:",
+		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
+		"      interval: 10s",
+		"      retries: 5",
+		`  ${service}-bucket:`,
+		"    image: minio/mc:latest",
+		"    depends_on:",
+		`      ${service}:`,
+		"        condition: service_healthy",
+		"    entrypoint: >",
+		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
+		`      mc mb --ignore-existing s3/${bucket}"`,
+		"    networks:",
+		"      - dokploy-network",
+		"volumes:",
+		`  ${service}-data:`,
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/**
+* A one-service compose file for Mailpit, on `dokploy-network` so the apps
+* reach it by its service name. It accepts mail from anything on the network
+* and delivers none of it.
+*/
+function mailpitCompose(service) {
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: axllent/mailpit:latest",
+		"    environment:",
+		"      MP_SMTP_AUTH_ACCEPT_ANY: '1'",
+		"      MP_SMTP_AUTH_ALLOW_INSECURE: '1'",
+		"    networks:",
+		"      - dokploy-network",
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/**
+* The S3 client's shared keys the stage set, for a bucket that is its own —
+* none when it set none, since a bucket's URL may carry its own key.
+*/
+function storageKeys(values) {
+	const keys = {};
+	for (const key of [...STORAGE_KEY_PAIR, "AWS_REGION"]) {
+		const value = values?.[key];
+		if (value !== void 0) keys[key] = value;
+	}
+	return keys;
+}
+/**
+* The error for a bucket or mail the stage configured nothing for — what
+* the deploy's readiness check (`assertStageReady`) already refused, should a
+* provisioner be called on its own without it.
+*/
+function notConfigured(id, kind, context) {
+	const { missing } = externalServices({
+		stage: context.stage,
+		declarations: [{
+			id,
+			kind
+		}],
+		supplied: context.supplied ?? {},
+		allow: false,
+		...context.domain ? { domain: context.domain } : {}
+	});
+	return new ExternalServicesNotConfigured(context.stage, missing);
+}
+/** Whether anything reads through a reader on this construct. */
+function readsFrom(manifest, id) {
+	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
+}
+/** The schema a database or tenant pins on its roles. */
+function schemaOf(manifest, id) {
+	const declaration = manifest[id];
+	if (declaration?.kind === "database") return declaration.schema ?? "app";
+	if (declaration?.kind === "database-schema") return declaration.schema;
+}
+/**
+* The one declared database, where `cache: 'db'` has to pick.
+*
+* Unambiguous with one and arbitrary with two, so two is an error rather than a
+* coin toss — a cache landing in a database nobody chose surfaces as entries
+* that are never found, long after the deploy reported success.
+*/
+function soleDatabase(context) {
+	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
+	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
+	return databases[0];
+}
+/**
+* A password derived from the stage's seed, the project, the stage and the role.
+*
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
+*/
+function derivedPassword(context, role) {
+	return createHash("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/** A connection string for a role on a cluster. */
+function postgresUrl(role, password, host, database) {
+	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
+}
+/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
+function quoted(name) {
+	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
+}
+/** A provisioner was handed a declaration of the wrong kind. */
+/**
+* A value only the stage's own secrets can hold.
+*
+* @throws {MissingSuppliedSecret} when the stage was never given it.
+*/
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
+}
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends GkmError {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
+var WrongKind = class extends Error {
+	kind;
+	constructor(kind) {
+		super(`No Dokploy provisioner handles '${kind}'`);
+		this.kind = kind;
+		this.name = "WrongKind";
+	}
+};
+/** A derived construct whose parent has not been provisioned. */
+var UnresolvedParent = class extends Error {
+	id;
+	parent;
+	constructor(id, parent) {
+		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
+		this.id = id;
+		this.parent = parent;
+		this.name = "UnresolvedParent";
+	}
+};
+/** A cache with nowhere to live. */
+var CacheNeedsAHome = class extends GkmError {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
+		this.id = id;
+		this.backend = backend;
+		this.name = "CacheNeedsAHome";
+	}
+};
+/** A `'db'` cache (a server target's default) with more than one database. */
+var CacheIsAmbiguous = class extends GkmError {
+	databases;
+	constructor(databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+/** A surface reached provisioning before its domain existed. */
+var SurfaceHasNoAddress = class extends GkmError {
+	id;
+	constructor(id) {
+		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
+		this.id = id;
+		this.name = "SurfaceHasNoAddress";
+	}
+};
+/** A queue or topic on a backend this target has no primitive for. */
+var UnprovisionableCarrier = class extends GkmError {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableCarrier";
+	}
+};
+/** A pg-boss carrier in an app that declares no database to host it. */
+var BrokerNeedsADatabase = class extends GkmError {
+	id;
+	constructor(id) {
+		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
+		this.id = id;
+		this.name = "BrokerNeedsADatabase";
+	}
+};
+/** A bucket on a backend this target has no primitive for. */
+var UnprovisionableBucket = class extends GkmError {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableBucket";
+	}
+};
+//#endregion
+//#region src/target/dokploy/declared.ts
+/**
+* The declared half of a Dokploy deploy.
+*
+* `fromManifest.ts` decides what each construct resolves to; this runs it —
+* discovers the manifest, walks it parents-first, and applies the DDL the
+* provisioners deferred.
+*
+* It is deliberately separate from the engine in `index.ts`. That file deploys
+* *applications*: images, registries, domains, the things a project has whether
+* or not it declares anything. This is the part that exists because the app
+* declared it, and keeping the two apart is what lets a project adopt the model
+* without rewriting its deploy — and lets this one be tested without one.
+*/
+/**
+* Provision everything the workspace declares, and return what it resolved.
+*/
+async function provisionDeclared(options) {
+	const { workspace } = options;
+	const empty = {
+		env: {},
+		statements: [],
+		provisioned: {},
+		clusters: {}
+	};
+	const manifest = options.manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	if (Object.keys(manifest).length === 0) return empty;
+	const context = {
+		manifest,
+		provisioned: {},
+		api: options.api,
+		projectId: options.projectId,
+		environmentId: options.environmentId,
+		stage: options.stage,
+		project: workspace.name,
+		scope: options.scope ?? workspace.name,
+		cache: cacheBackendFor(providerOf(workspace)),
+		events: eventsBackendFor(providerOf(workspace)),
+		storage: storageBackendFor(providerOf(workspace)),
+		...options.devServices ? { devServices: options.devServices } : {},
+		...workspace.domains?.[options.stage] ? { domain: workspace.domains[options.stage] } : {},
+		addresses: surfaceAddresses(manifest, options.appUrls),
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
+		deferred: [],
+		clusters: {}
+	};
+	const env = {};
+	for (const id of carriersLast(provisionOrder(manifest), manifest)) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const provisioner = provisionerFor(declaration.kind);
+		if (!provisioner) continue;
+		const result = await provisioner(declaration, context);
+		context.provisioned[id] = result;
+		Object.assign(env, result.provides);
+	}
+	return {
+		env,
+		statements: context.deferred.map((statement) => ({
+			id: statement.id,
+			describe: statement.describe,
+			...statement.database ? { database: statement.database } : {},
+			...statement.exists ? { exists: statement.exists } : {},
+			create: statement.sql
+		})),
+		provisioned: context.provisioned,
+		clusters: context.clusters
+	};
+}
+/**
+* Run the deferred DDL against a cluster that is now reachable.
+*
+* The same applier the local target uses: every statement asks whether it is
+* needed first, so a redeploy is free and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclared(client, statements) {
+	return (await applyPostgres(client, statements)).filter((entry) => entry.created).length;
+}
+/**
+* The provisioning order, with queues and topics moved to the end.
+*
+* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
+* *derived from* a database, because under SNS it does not live in one. Where
+* it lives is a fact about the backend, which is config — so the dependency is
+* real under pg-boss and absent under SNS, and writing it into the declaration
+* would state it in the one place that cannot know.
+*
+* Here it can. This runs where the backend is known, and the rule needs no
+* branch on it: nothing depends on a carrier. A queue's worker and a topic's
+* subscribers are *bound* to it rather than dependent on it, which is why
+* neither holds a key of its own — so a carrier can always go last, and under
+* pg-boss that is exactly late enough for the database it reads to be there.
+*/
+function carriersLast(ordered, manifest) {
+	const carries = (id) => {
+		const kind = manifest[id]?.kind;
+		return kind === "queue" || kind === "topic";
+	};
+	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
+}
+/**
+* Where each declared surface answers: its own app's address.
+*
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
+*/
+function surfaceAddresses(manifest, appUrls) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[appKey(id)];
+		if (url) addresses[id] = url;
+	}
+	return addresses;
+}
+//#endregion
+//#region src/target/dokploy/env-resolver.ts
+/**
+* Environment Variable Resolution for Dokploy Deployments
+*
+* Resolves sniffed environment variables to actual values during deployment.
+* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
+* and falls back to user-provided secrets.
+*/
+/**
+* Generate a secure random secret (64 hex characters = 32 bytes)
+*/
+function generateSecret() {
+	return randomBytes(32).toString("hex");
+}
+/**
+* Get or generate a secret for an app.
+* If the secret already exists in state, returns it.
+* Otherwise generates a new one and stores it.
+*/
+function getOrGenerateSecret(state, appName, secretName) {
+	const existing = getGeneratedSecret(state, appName, secretName);
+	if (existing) return existing;
+	const generated = generateSecret();
+	setGeneratedSecret(state, appName, secretName, generated);
+	return generated;
+}
+/**
+* Resolve a single environment variable
+*/
+function resolveEnvVar(varName, context) {
+	if (isReservedStageKey(varName)) return void 0;
+	switch (varName) {
+		case "PORT": return String(context.app.port);
+		case "NODE_ENV": return "production";
+		case "STAGE": return context.stage;
+		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
+		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
+		case "BETTER_AUTH_TRUSTED_ORIGINS":
+			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
+			break;
+		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
+	}
+	if (context.dependencyUrls && varName.endsWith("_URL")) {
+		const depName = (stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
+		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
+	}
+	if (context.userSecrets) {
+		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
+		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
+		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
+		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
+	}
+}
+/**
+* Resolve all environment variables for an app
+*/
+function resolveEnvVars(requiredVars, context) {
+	const resolved = {};
+	const missing = [];
+	for (const varName of requiredVars) {
+		const value = resolveEnvVar(varName, context);
+		if (value !== void 0) resolved[varName] = value;
+		else missing.push(varName);
+	}
+	return {
+		resolved,
+		missing
+	};
+}
+/**
+* Format missing variables error message
+*/
+function formatMissingVarsError(appName, missing, stage) {
+	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+}
+/**
+* Validate that all required environment variables can be resolved
+*/
+function validateEnvVars(requiredVars, context) {
+	const { resolved, missing } = resolveEnvVars(requiredVars, context);
+	return {
+		valid: missing.length === 0,
+		missing,
+		resolved
+	};
+}
+//#endregion
+//#region src/target/dokploy/health.ts
+/**
+* Whether a released app answers.
+*
+* Dokploy finishing a deployment means the service was updated, not that the
+* process in it is serving: a container that exits on start, a missing
+* variable read at boot, a database it cannot reach all look like a finished
+* deployment. So an app counts as released once its own health route has
+* answered 2xx several times in a row — one lucky answer from a container
+* about to crash-loop is not enough.
+*/
+/** How long one request may take: a check that hangs is a failed check. */
+const REQUEST_TIMEOUT_MS = 1e4;
+/** An app never answered healthy enough times in a row. */
+var HealthCheckTimedOut = class extends GkmError {
+	app;
+	url;
+	timeoutMs;
+	lastStatus;
+	constructor(app, url, timeoutMs, lastStatus) {
+		super(`${app} did not become healthy within ${Math.round(timeoutMs / 1e3)}s: ${url} last ${lastStatus === void 0 ? "did not answer" : `answered ${lastStatus}`}. Check the app's logs in Dokploy. If it is only slow to start, raise deploy.dokploy.verify.healthTimeoutMs; if it serves its health route elsewhere, set deploy.dokploy.verify.healthCheckPath.`);
+		this.app = app;
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "HealthCheckTimedOut";
+	}
+};
+/** Wait `ms`, or reject with the signal's reason once it aborts. */
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) return reject(signal.reason);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal.reason);
+		};
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** One request: its status, or undefined when it never answered. */
+async function probe(url, signal) {
+	try {
+		const response = await fetch(url, { signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) });
+		response.body?.cancel().catch(() => {});
+		return response.status;
+	} catch {
+		signal.throwIfAborted();
+		return;
+	}
+}
+/**
+* Check `url` until it answers 2xx `healthyAfter` times in a row, emitting
+* `health.checked` for every check.
+*
+* @throws {HealthCheckTimedOut} when that has not happened within `timeoutMs`.
+*/
+async function verifyHealth(check) {
+	const { app, url, healthyAfter, intervalMs, timeoutMs, signal, emit } = check;
+	const deadline = Date.now() + timeoutMs;
+	let consecutive = 0;
+	let attempt = 0;
+	while (true) {
+		attempt++;
+		const status = await probe(url, signal);
+		const healthy = status !== void 0 && status >= 200 && status < 300;
+		emit({
+			type: "health.checked",
+			app,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		consecutive = healthy ? consecutive + 1 : 0;
+		if (consecutive >= healthyAfter) return;
+		if (Date.now() + intervalMs > deadline) throw new HealthCheckTimedOut(app, url, timeoutMs, status);
+		await sleep(intervalMs, signal);
+	}
+}
+/** The migrations of a deployed stage failed; the release stopped before any app. */
+var DeployMigrationsFailed = class extends Error {
+	stage;
+	reason;
+	constructor(stage, reason, message) {
+		super(`Migrating "${stage}" failed, so no app was released: ${message}. Migrations applied before the failing one stay applied; fix it and deploy again.`);
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "DeployMigrationsFailed";
+	}
+};
+/**
+* The URLs a stage's migrations and seeds connect with, keyed as the migrator
+* reads them, grouped by the database their cluster serves — for the targets
+* that have a migration or a seed to run. Empty when none does, so a deploy
+* publishes nothing for a project that has written neither.
+*/
+async function migrationUrls(root, manifest, env) {
+	const byDatabase = /* @__PURE__ */ new Map();
+	for (const target of migrationTargets(manifest)) {
+		const migrations = await migrationFiles(join(root, target.migrations));
+		const seeds = await migrationFiles(join(root, target.seeds));
+		if (migrations.size === 0 && seeds.size === 0) continue;
+		for (const role of ["ownerUrl", "url"]) {
+			const key = provideKey(target.id, role);
+			const url = env[key];
+			if (!url) continue;
+			const database = new URL(url).pathname.slice(1);
+			byDatabase.set(database, {
+				...byDatabase.get(database),
+				[key]: url
+			});
+		}
+	}
+	return byDatabase;
+}
+const answer = discriminatedUnion("reason", [object({
+	reason: literal("migrated"),
+	runs: array(object({
+		construct: string(),
+		migrations: string(),
+		applied: array(string())
+	})),
+	seeds: array(object({
+		construct: string(),
+		seeds: string(),
+		seeded: array(string())
+	}))
+}), object({
+	reason: literal("failed"),
+	error: looseObject({
+		name: string(),
+		message: string()
+	})
+})]);
+/**
+* Apply every pending migration, then run every seed, in the sandbox, as each
+* construct's owner. A failing migration throws `DeployMigrationsFailed`, a
+* failing seed `DeploySeedsFailed` — either before any app is released.
+*/
+async function runMigrations(options) {
+	const sandbox = options.sandbox ?? activeSandbox() ?? new LocalSandbox({ root: options.root });
+	const { value } = await runWorker(sandbox, "migrations", {
+		name: "migrate-worker",
+		args: [JSON.stringify({
+			root: options.root,
+			stage: options.stage,
+			manifest: options.manifest,
+			patterns: options.patterns
+		})],
+		cwd: options.root,
+		timeoutMs: options.timeoutMs ?? 9e5,
+		secrets: options.urls,
+		signal: options.signal,
+		schema: answer
+	});
+	if (value.reason === "failed") {
+		const { error } = value;
+		if (error.name === "SeedFailed") throw new DeploySeedsFailed(options.stage, String(error.construct ?? "unknown"), String(error.seed ?? "unknown"), error);
+		throw new DeployMigrationsFailed(options.stage, error.name, error.message);
+	}
+	return {
+		migrations: value.runs,
+		seeds: value.seeds
+	};
+}
+//#endregion
+//#region src/target/dokploy/postgres.ts
+/**
+* Reaching a Dokploy Postgres from where the deploy runs.
+*
+* A Dokploy Postgres answers on the server's Docker network and nowhere else:
+* its address is its service name, which only another container there
+* resolves. Two steps of a deploy need it from outside — the role DDL the
+* provisioners defer, and the migrations `release` applies — so the cluster
+* is published on an external port for exactly as long as they take, and
+* closed again whatever happens.
+*/
+const logger$1 = output;
+/** A Postgres published for the role DDL never accepted a connection. */
+var PostgresNotReady = class extends GkmError {
+	host;
+	port;
+	attempts;
+	constructor(host, port, attempts) {
+		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
+		this.host = host;
+		this.port = port;
+		this.attempts = attempts;
+		this.name = "PostgresNotReady";
+	}
+};
+/** No port could be published for a cluster, so its DDL cannot reach it. */
+var PostgresPortUnavailable = class extends GkmError {
+	appName;
+	taken;
+	constructor(appName, taken) {
+		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
+		this.appName = appName;
+		this.taken = taken;
+		this.name = "PostgresPortUnavailable";
+	}
+};
+/**
+* Wait for Postgres to be ready to accept connections.
+*
+* Polls the Postgres server until it accepts a connection or max retries reached.
+* Used after enabling the external port to ensure the database is accessible
+* before creating users.
+*
+* @throws {PostgresNotReady} if Postgres is not ready after maxRetries
+*/
+async function waitForPostgres(host, port, user, password, database, maxRetries = 30, retryIntervalMs = 2e3) {
+	for (let i = 0; i < maxRetries; i++) try {
+		const client = new Client({
+			host,
+			port,
+			user,
+			password,
+			database,
+			connectionTimeoutMillis: 5e3
+		});
+		client.on("error", () => {});
+		await client.connect();
+		await client.end();
+		return;
+	} catch {
+		if (i < maxRetries - 1) {
+			logger$1.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			await new Promise((r) => setTimeout(r, retryIntervalMs));
+		}
+	}
+	throw new PostgresNotReady(host, port, maxRetries);
+}
+/**
+* A high port for one service, the same one every time.
+*
+* Derived from the service name rather than random so two deploys of the same
+* database agree and two different databases do not collide — and in the
+* ephemeral range, above anything a server is likely to have bound
+* deliberately.
+*/
+function derivedPort(appName) {
+	const digest = createHash("sha256").update(appName).digest();
+	return 49152 + (digest[0] << 8 | digest[1]) % 16e3;
+}
+/** The hostname of the Dokploy server, from its API endpoint. */
+function serverHostname(endpoint) {
+	return new URL(endpoint).hostname;
+}
+/**
+* Publish `cluster` on an external port of the server at `host`, and wait
+* until it accepts a connection there.
+*/
+async function publishPostgres(api, cluster, host) {
+	let externalPort = await api.getPostgres(cluster.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
+	const opened = externalPort === void 0;
+	if (externalPort === void 0) {
+		const taken = await api.publishedPorts().catch(() => /* @__PURE__ */ new Set());
+		const candidates = [5432, derivedPort(cluster.appName)].filter((port) => !taken.has(port));
+		for (const candidate of candidates) try {
+			await api.savePostgresExternalPort(cluster.postgresId, candidate);
+			externalPort = candidate;
+			break;
+		} catch (error) {
+			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
+			logger$1.log(`   Port ${candidate} is taken; trying another...`);
+		}
+		if (externalPort === void 0) throw new PostgresPortUnavailable(cluster.appName, [...taken]);
+		logger$1.log(`   Publishing ${cluster.appName} on ${externalPort}...`);
+	}
+	const port = externalPort;
+	let closed = false;
+	const close = async () => {
+		if (!opened || closed) return;
+		closed = true;
+		await api.savePostgresExternalPort(cluster.postgresId, null).then(() => api.deployPostgres(cluster.postgresId)).catch(() => {
+			logger$1.log(`   ⚠ Could not close external port ${port} on ${cluster.appName} — close it in Dokploy.`);
+		});
+	};
+	try {
+		await api.deployPostgres(cluster.postgresId);
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName);
+	} catch (error) {
+		await close();
+		throw error;
+	}
+	return {
+		cluster,
+		host,
+		port,
+		close
+	};
+}
+/**
+* A URL the cluster's containers use — its service name, its internal port —
+* pointed at where `published` answers from here instead.
+*/
+function publishedUrl(url, published) {
+	const parsed = new URL(url);
+	parsed.hostname = published.host;
+	parsed.port = String(published.port);
+	return parsed.toString();
+}
+/**
+* Run the manifest's DDL against a published Dokploy Postgres.
+*
+* The applier is the local target's, so every statement asks whether it is
+* needed first: a redeploy is free, and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclaredStatements(published, statements) {
+	const { cluster, host, port } = published;
+	const client = { async query(database, sql, values) {
+		const connection = new Client({
+			host,
+			port,
+			user: cluster.databaseUser,
+			password: cluster.databasePassword,
+			database: database ?? cluster.databaseName,
+			connectionTimeoutMillis: 15e3
+		});
+		connection.on("error", () => {});
+		await connection.connect();
+		try {
+			return (await connection.query(sql, values)).rows;
+		} finally {
+			await connection.end();
+		}
+	} };
+	let lastError;
+	for (let attempt = 1; attempt <= 3; attempt++) try {
+		return await applyDeclared(client, statements);
+	} catch (error) {
+		lastError = error;
+		if (attempt === 3) break;
+		const message = error instanceof Error ? error.message : String(error);
+		logger$1.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+		await new Promise((resolve) => setTimeout(resolve, 1e4));
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName).catch(() => {});
+	}
+	throw lastError;
+}
+//#endregion
+//#region src/target/dokploy/engine.ts
+const logger = output;
+/**
+* The variables an app cannot start without.
+*
+* The sniffer reports every key it saw in `requiredEnvVars` and says which of
+* them were read through `.optional()` or `.default()` in `optionalEnvVars`.
+* Reading only the first treats a key that is *absent by design* as a missing
+* secret — `AUTH_COOKIE_DOMAIN` is published only when a surface has a domain
+* to widen a cookie to, and one host has nothing to share it with.
+*
+* The same distinction `bundleServer` draws. It is drawn twice because the
+* bundle and the deploy each validate, and the deploy was the half still
+* failing on an answer that was correct.
+*/
+function requiredOf(requirements) {
+	if (!requirements) return [];
+	const optional = new Set(requirements.optionalEnvVars);
+	return requirements.requiredEnvVars.map((name) => name.endsWith("?") ? name.slice(0, -1) : name).filter((name) => !optional.has(name));
+}
+/** A backend failed, so the run stopped before deploying anything after it. */
+var BackendDeployFailed = class extends Error {
+	app;
+	constructor(app, cause) {
+		super(`Backend deployment failed for ${app}. Aborting to prevent partial deployment.`, { cause });
+		this.app = app;
+		this.name = "BackendDeployFailed";
+	}
+};
+/**
+* Sites failed to release or to answer. Every site is attempted before this
+* is thrown, so one broken site does not keep the others back — but the run
+* fails, and what failed is rolled back.
+*/
+var FrontendDeployFailed = class extends Error {
+	apps;
+	constructor(apps, cause) {
+		super(`Frontend deployment failed for ${apps.join(", ")}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.apps = apps;
+		this.name = "FrontendDeployFailed";
+	}
+};
+/** An app's environment needs values the stage does not have. */
+var MissingEnvVars = class extends GkmError {
+	app;
+	missing;
+	stage;
+	constructor(app, missing, stage) {
+		super(formatMissingVarsError(app, [...missing], stage));
+		this.app = app;
+		this.missing = missing;
+		this.stage = stage;
+		this.name = "MissingEnvVars";
+	}
+};
+/** How `resolveProject` found a project, in the journal's words. */
+const PROJECT_VIA = {
+	state: "recorded",
+	marker: "found",
+	created: "created"
+};
+/** `childOutput` as `spawn` reads it, where it is not the default. */
+const CHILD_STDIO = {
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/** The defaults of `deploy.dokploy.verify`. */
+function verifySettings(config) {
+	return {
+		deploymentTimeoutMs: config?.deploymentTimeoutMs ?? 6e5,
+		healthCheckPath: config?.healthCheckPath ?? "/health",
+		healthyAfter: config?.healthyAfter ?? 3,
+		intervalMs: config?.intervalMs ?? 2e3,
+		healthTimeoutMs: config?.healthTimeoutMs ?? 3e5
+	};
+}
+/**
+* Deploy every app in a workspace to Dokploy: the engine under the built-in
+* `dokploy` target.
+*
+* Two-phase orchestration:
+* - PHASE 1: Deploy backend apps (with encrypted secrets)
+* - PHASE 2: Deploy frontend apps (with public URLs from backends)
+*
+* Security model:
+* - Backend apps get encrypted secrets embedded at build time
+* - Only GKM_MASTER_KEY is injected as Dokploy env var
+* - Frontend apps get public URLs baked in at build time (no secrets)
+*
+* The run around it — the target, the apps, the lock, the phase events — is
+* `runDeploy`'s. This says what it is doing and checks what Dokploy needs.
+*
+* @internal
+*/
+async function validateDokploy(phase) {
+	const { workspace, stage, identity, tag: imageTag } = phase;
+	const ctx = {
+		emit: phase.emit,
+		credentials: phase.credentials,
+		signal: phase.signal,
+		dryRun: phase.dryRun,
+		...phase.childOutput !== "inherit" ? { stdio: CHILD_STDIO[phase.childOutput] } : {}
+	};
+	logger.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
+	logger.log(`   Stage: ${stage}`);
+	logger.log(`   Tag: ${imageTag}`);
+	const askedFor = /* @__PURE__ */ new Set([...phase.apps, ...phase.skipped.map((skipped) => skipped.app)]);
+	const asked = getAppBuildOrder(workspace).filter((name) => askedFor.has(name));
+	logger.log(asked.length === Object.keys(workspace.apps).length ? `   Deploying all apps: ${asked.join(", ")}` : `   Deploying apps: ${asked.join(", ")}`);
+	for (const { app, reason } of phase.skipped) logger.log(`   ⚠️  Skipping ${app}: ${reason}`);
+	const appsToDeployNames = [...phase.apps];
+	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") phase.skip(name, MOBILE_SKIP_REASON);
+	const run = {
+		workspace,
+		manifest: phase.manifest,
+		stage,
+		imageTag,
+		appsToDeployNames,
+		identity,
+		store: phase.state,
+		skipped: phase.skipped,
+		secrets: phase.secrets,
+		ctx
+	};
+	const stored = await phase.secrets.read();
+	const services = externalServices({
+		stage,
+		declarations: stageServiceDeclarations({
+			manifest: phase.manifest,
+			...phase.runnables ? { runnables: phase.runnables } : {}
+		}),
+		supplied: stored?.custom ?? {},
+		allow: phase.allowDevServices,
+		...workspace.domains?.[stage] ? { domain: workspace.domains[stage] } : {},
+		providers: stageProviderNotes(workspace, stage)
+	});
+	const devServices = devServicesUsed(services);
+	const runnables = phase.runnables ?? {};
+	const background = phase.background ?? {};
+	const workers = workerUnits(workspace, phase.manifest, background).filter((worker) => appsToDeployNames.includes(worker.app));
+	if (workers.length > 0) logger.log(`   Deploying workers: ${workers.map((w) => `${w.name} (from ${w.app})`).join(", ")}`);
+	return {
+		...run,
+		devServices: devServices.map((use) => use.service),
+		workers,
+		runnables,
+		preflight: await preflight(run),
+		verify: verifySettings(workspace.deploy.dokploy?.verify),
+		atomic: phase.atomic,
+		releasing: {
+			switched: /* @__PURE__ */ new Map(),
+			failed: /* @__PURE__ */ new Set()
+		},
+		published: /* @__PURE__ */ new Map()
+	};
+}
+/**
+* The stage's secrets and every app's environment requirements. A dry run
+* reads the secrets and generates nothing into the store.
+*/
+async function preflight({ workspace, manifest, stage, secrets: secretsStore, ctx }) {
+	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
+	const stored = await secretsStore.read();
+	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
+	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	if (generated.length > 0) {
+		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
+		else {
+			await secretsStore.write(stageSecrets);
+			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
+		}
+	}
+	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
+	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
+	if (stageSecrets) {
+		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
+		if (report.appsWithSecrets.length > 0) logger.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
+		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
+	}
+	return {
+		stageSecrets,
+		sniffedApps,
+		encryptedSecrets
+	};
+}
+/**
+* The project, environment and registry, then what the manifest declares.
+* Each is looked up — by the id the stage's state recorded, else by name —
+* before it is created, so a run stopped part way is finished by the next.
+*/
+async function provisionDokploy(run) {
+	try {
+		await provision(run);
+	} catch (error) {
+		await closePublished(run);
+		throw error;
+	}
+}
+/** Unpublish every cluster the run still has published. */
+async function closePublished(run) {
+	for (const published of run.published.values()) await published.close();
+	run.published.clear();
+}
+async function provision(run) {
+	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
+	const { stageSecrets } = run.preflight;
+	const changes = [];
+	const applied = (change, via) => {
+		changes.push(change);
+		ctx.emit({
+			type: "resource.applied",
+			...change,
+			via
+		});
+	};
+	const { api, endpoint } = await dokployApi(workspace, ctx);
+	logger.log("\n📋 Loading deploy state...");
+	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""), asDokployState);
+	const state = journal.state;
+	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
+	else logger.log(`   Creating new state for stage "${stage}"`);
+	const unfinished = journal.unfinished();
+	if (unfinished.length > 0) logger.log(`   ⚠ A previous run stopped while creating: ${unfinished.join(", ")} — looking for them before creating anything`);
+	logger.log("\n📁 Setting up Dokploy project...");
+	logger.log(`   Identity: ${identity.key}`);
+	const projectEntry = {
+		key: "project",
+		type: "project",
+		data: {
+			name: projectName(identity),
+			identity: identity.key
+		}
+	};
+	const project = await resolveProject(api, identity, state.projectId || void 0, (message) => logger.log(message), { beforeCreate: () => journal.pending(projectEntry) });
+	await journal.ready(projectEntry, project.projectId);
+	applied({
+		key: "project",
+		resourceType: "project",
+		action: project.via === "created" ? "create" : "reuse",
+		id: project.projectId
+	}, PROJECT_VIA[project.via]);
+	if (project.via === "created") logger.log(`   ✓ Created project: ${project.projectId}`);
+	else logger.log(`   Found existing project: ${project.name}`);
+	const environmentEntry = {
+		key: "environment",
+		type: "environment",
+		data: { name: stage }
+	};
+	const environment = await journal.ensure(environmentEntry, {
+		find: async () => project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase()),
+		create: () => {
+			logger.log(`   Creating "${stage}" environment...`);
+			return api.createEnvironment(project.projectId, stage);
+		},
+		id: (e) => e.environmentId
+	});
+	const environmentId = environment.resource.environmentId;
+	applied({
+		key: "environment",
+		resourceType: "environment",
+		action: environment.via === "created" ? "create" : "reuse",
+		id: environmentId
+	}, environment.via);
+	if (environment.via === "created") logger.log(`   ✓ Created environment: ${stage}`);
+	else logger.log(`   Using environment: ${environment.resource.name}`);
+	if (journal.existed) {
+		if (state.projectId && state.projectId !== project.projectId) logger.log(`   ⚠ Project ID changed, updating state`);
+		if (state.environmentId && state.environmentId !== environmentId) logger.log(`   ⚠ Environment ID changed, updating state`);
+	}
+	state.projectId = project.projectId;
+	state.environmentId = environmentId;
+	state.identity = identity.key;
+	logger.log("\n🐳 Checking registry...");
+	const registry = workspace.deploy.registry;
+	let registryCreated = false;
+	const dokployRegistry = await resolveRegistry(api, {
+		stage,
+		registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state.registryId,
+		log: (message) => logger.log(message),
+		create: async (url) => {
+			const login = await ctx.credentials.get({
+				kind: "registry",
+				url
+			}, { signal: ctx.signal });
+			if (!login) throw new MissingCredential("registry", url);
+			const created = await api.createRegistry("Default Registry", url, login.username, login.password);
+			registryCreated = true;
+			logger.log(`   ✓ Registry created: ${created.registryId}`);
+			return created;
+		}
+	});
+	const registryId = dokployRegistry.registryId;
+	state.registryId = registryId;
+	applied({
+		key: "registry",
+		resourceType: "registry",
+		action: registryCreated ? "create" : "reuse",
+		id: registryId
+	}, registryCreated ? "created" : "found");
+	logger.log(`   Using registry: ${dokployRegistry.registryName}`);
+	await journal.save();
+	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
+	if (skippedMobileApps.length > 0) logger.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
+	let declaredEnv = {};
+	let declaredClusters = {};
+	let migrations = /* @__PURE__ */ new Map();
+	{
+		logger.log("\n📦 Provisioning declared constructs...");
+		const appUrls = {};
+		for (const appName of appsToDeployNames) {
+			if (workspace.apps[appName]?.type !== "backend") continue;
+			appUrls[appName] = `https://${hostOf(workspace, appName, stage)}`;
+		}
+		const declared = await provisionDeclared({
+			api,
+			workspace,
+			projectId: project.projectId,
+			environmentId,
+			stage,
+			scope: identity.scope,
+			appUrls,
+			supplied: stageSecrets.custom,
+			seed: stageSecrets.seed,
+			manifest,
+			devServices: run.devServices
+		});
+		declaredEnv = declared.env;
+		declaredClusters = declared.clusters;
+		if (Object.keys(declaredEnv).length > 0) logger.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
+		migrations = await migrationUrls(workspace.root, manifest, declaredEnv);
+		const host = serverHostname(endpoint);
+		for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
+			const statements = declared.statements.filter((statement) => statement.database === databaseName);
+			if (statements.length === 0) continue;
+			const published = await publishPostgres(api, cluster, host);
+			run.published.set(databaseName, published);
+			const created = await applyDeclaredStatements(published, statements);
+			if (!migrations.has(databaseName)) {
+				await published.close();
+				run.published.delete(databaseName);
+			}
+			logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+		}
+	}
+	const backupCluster = Object.values(declaredClusters)[0];
+	const dokployBackups = workspace.deploy?.dokploy?.backups;
+	if (dokployBackups && backupCluster) {
+		logger.log("\n💾 Provisioning backup destination...");
+		const { provisionBackupDestination } = await import("./backup-provisioner-C8DnCmxK.mjs");
+		const backupState = await provisionBackupDestination({
+			api,
+			projectId: project.projectId,
+			projectName: identity.scope,
+			stage,
+			config: dokployBackups,
+			existingState: getBackupState(state),
+			logger
+		});
+		setBackupState(state, backupState);
+		if (!backupState.postgresBackupId) {
+			const backupSchedule = dokployBackups.schedule ?? "0 2 * * *";
+			const backupRetention = dokployBackups.retention ?? 30;
+			logger.log("   Creating postgres backup schedule...");
+			const backup = await api.createPostgresBackup({
+				schedule: backupSchedule,
+				prefix: `${stage}/postgres`,
+				destinationId: backupState.destinationId,
+				database: backupCluster.databaseName,
+				postgresId: backupCluster.postgresId,
+				enabled: true,
+				keepLatestCount: backupRetention
+			});
+			setPostgresBackupId(state, backup.backupId);
+			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger.log("   ✓ Using existing postgres backup schedule");
+	}
+	run.provisioned = {
+		api,
+		endpoint,
+		journal,
+		state,
+		projectId: project.projectId,
+		environmentId,
+		registry,
+		registryId,
+		declaredEnv,
+		declaredClusters,
+		migrations,
+		changes,
+		applied
+	};
+}
+/**
+* The stage's migrations, then each app's image built and pushed, its
+* application configured and deployed, and its domain attached — counted as
+* released only once Dokploy's deployment has finished.
+*
+* Backends first, each failure stopping the run; then they are checked, and
+* a backend that does not answer stops the run too — a site built against an
+* API that is down is a site that is down. Then the sites, whose build args
+* are the backends' public URLs: every one is attempted, and any that failed
+* fails the run. `verify` checks the sites.
+*
+* Building is here rather than in a `build` phase of its own because an
+* image is built beside its application — a site's build args are resolved
+* per app, against the backends released before it.
+*/
+async function releaseDokploy(run) {
+	const { workspace, stage, imageTag, appsToDeployNames, identity, ctx } = run;
+	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
+	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
+	const project = { projectId: run.provisioned.projectId };
+	const telemetry = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "dokploy",
+		runtime: "server",
+		selfHosted: false,
+		used: usesTelemetry(run.manifest)
+	});
+	const telemetryValues = telemetry?.provider === "otlp" ? otlpTelemetryEnv(telemetry) : void 0;
+	try {
+		await migrate(run);
+	} finally {
+		await closePublished(run);
+	}
+	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
+	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
+	const publicUrls = {};
+	const results = [];
+	const appHostnames = /* @__PURE__ */ new Map();
+	const appDomainIds = /* @__PURE__ */ new Map();
+	const released = {
+		results,
+		publicUrls,
+		appHostnames,
+		appDomainIds,
+		applicationIds: /* @__PURE__ */ new Map()
+	};
+	run.released = released;
+	/** An app is up: say so, and remember where. */
+	const deployed = (appName, result, host) => {
+		const url = `https://${host}`;
+		results.push({
+			...result,
+			success: true,
+			url
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: appName,
+			applicationId: result.applicationId,
+			imageRef: result.imageRef,
+			url
+		});
+	};
+	/** An image is pushed: worth keeping even if what follows fails. */
+	const built = (appName, image, ref) => {
+		ctx.emit({
+			type: "artifact.built",
+			app: appName,
+			imageRef: image.imageRef ?? ref,
+			...image.digest ? { digest: image.digest } : {}
+		});
+		changes.push({
+			key: `image:${appName}`,
+			resourceType: "image",
+			action: "build",
+			id: image.digest ?? image.imageRef ?? ref
+		});
+	};
+	/**
+	* Point an app's application at its image and environment, deploy it,
+	* attach its domain, and wait for Dokploy to finish — then record the
+	* release, with what ran before it as the one a rollback restores.
+	*/
+	const release = async (appName, applicationId, image, envVars, host) => {
+		released.applicationIds.set(appName, applicationId);
+		const since = await api.latestDeploymentAt(applicationId);
+		const before = state.releases?.[appName]?.current;
+		run.releasing.switched.set(appName, {
+			applicationId,
+			...before ? { before } : {}
+		});
+		await api.saveDockerProvider(applicationId, image.ref, { registryId });
+		await api.saveApplicationEnv(applicationId, envVars.join("\n"));
+		logger.log(`      Deploying to Dokploy...`);
+		await api.deployApplication(applicationId);
+		if (host) {
+			const domainId = await ensureDomain(api, journal, host, workspace.apps[appName].port, applicationId, applied);
+			appHostnames.set(appName, host);
+			if (domainId) appDomainIds.set(appName, domainId);
+		}
+		logger.log(`      Waiting for the deployment to finish...`);
+		await api.waitForDeployment(applicationId, {
+			since,
+			timeoutMs: run.verify.deploymentTimeoutMs,
+			intervalMs: run.verify.intervalMs,
+			signal: ctx.signal
+		});
+		recordRelease(state, appName, {
+			...image,
+			tag: imageTag
+		}, currentActor());
+		await journal.save();
+		if (host) publicUrls[appName] = `https://${host}`;
+	};
+	const frontendUrls = [];
+	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
+	if (backendApps.length > 0) {
+		logger.log("\n📦 PHASE 1: Deploying backend applications...");
+		for (const appName of backendApps) {
+			ctx.signal?.throwIfAborted();
+			const app = workspace.apps[appName];
+			logger.log(`\n   ⚙️  Deploying ${appName}...`);
+			try {
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId, applied);
+				const appSecrets = encryptedSecrets.get(appName);
+				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
+					encrypted: appSecrets.payload.encrypted,
+					iv: appSecrets.payload.iv
+				} : void 0;
+				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
+				const imageRef$1 = imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$1}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: imageName(identity, appName),
+						appName
+					},
+					credentials,
+					...dockerRun(workspace, app, ctx)
+				});
+				built(appName, image, imageRef$1);
+				const backendHost = hostOf(workspace, appName, stage);
+				const dependencyUrls = {};
+				if (app.dependencies) {
+					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
+				}
+				const envContext = {
+					app,
+					appName,
+					stage,
+					state,
+					appHostname: backendHost,
+					frontendUrls,
+					userSecrets: stageSecrets ?? void 0,
+					masterKey: appSecrets?.masterKey,
+					dependencyUrls
+				};
+				const sniffedVars = requiredOf(sniffedApps.get(appName));
+				const { valid, missing, resolved } = validateEnvVars([.../* @__PURE__ */ new Set([
+					"PORT",
+					"NODE_ENV",
+					"STAGE",
+					...sniffedVars
+				])], envContext);
+				if (!valid) throw new MissingEnvVars(appName, missing, stage);
+				const withDeclared = scopeTelemetryEnv({
+					...resolved,
+					...declaredEnv
+				}, {
+					uses: appTelemetry(run.manifest, appName) !== void 0,
+					serviceName: appName,
+					...telemetryValues ? { telemetry: telemetryValues } : {}
+				});
+				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
+				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, backendHost);
+				deployed(appName, {
+					appName,
+					type: app.type,
+					applicationId: application.applicationId,
+					imageRef: imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, backendHost);
+				logger.log(`      ✓ ${appName} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(run, appName, error);
+				throw new BackendDeployFailed(appName, error);
+			}
+		}
+		await settleDns(run, backendApps);
+		for (const appName of backendApps) try {
+			await checkHealth(run, appName);
+		} catch (error) {
+			if (ctx.signal?.aborted) throw ctx.signal.reason;
+			failed(run, appName, error);
+			throw new BackendDeployFailed(appName, error);
+		}
+	}
+	if (run.workers.length > 0) {
+		logger.log("\n🧵 Deploying workers...");
+		for (const worker of run.workers) {
+			ctx.signal?.throwIfAborted();
+			logger.log(`\n   🧵 Deploying ${worker.name} (worker ${worker.id})...`);
+			try {
+				const application = await ensureApplication(api, journal, worker.name, applicationName(identity, worker.name), project.projectId, environmentId, applied);
+				const keys = [...workerEnvKeys(run.manifest, worker.id, run.runnables) ?? []].sort();
+				const secrets = prepareSecretsForApp(stageSecrets, {
+					appName: worker.name,
+					requiredEnvVars: keys,
+					optionalEnvVars: []
+				});
+				const credentials = secrets.secretCount > 0 ? {
+					encrypted: secrets.payload.encrypted,
+					iv: secrets.payload.iv
+				} : void 0;
+				const imageRef$2 = imageRef(identity, worker.name, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$2}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: imageName(identity, worker.name),
+						appName: worker.name
+					},
+					credentials,
+					cwd: workspace.root,
+					dockerfile: workerDockerfileOf(worker.name),
+					...ctx.signal ? { signal: ctx.signal } : {},
+					...ctx.stdio ? { stdio: ctx.stdio } : {}
+				});
+				built(worker.name, image, imageRef$2);
+				const env = {
+					...scopeTelemetryEnv(Object.fromEntries(Object.entries(declaredEnv).filter(([key]) => keys.includes(key))), {
+						uses: telemetryOf(run.manifest, worker.id) !== void 0,
+						serviceName: worker.name,
+						...telemetryValues ? { telemetry: telemetryValues } : {}
+					}),
+					...credentials ? { GKM_MASTER_KEY: secrets.masterKey } : {},
+					NODE_ENV: "production",
+					PORT: String(WORKER_PORT),
+					STAGE: stage
+				};
+				logger.log(`      Resolved ${Object.keys(env).length} env vars: ${Object.keys(env).sort().join(", ")}`);
+				await release(worker.name, application.applicationId, {
+					ref: image.imageRef ?? imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, Object.entries(env).map(([key, value]) => `${key}=${value}`), void 0);
+				await checkHealth(run, worker.name);
+				results.push({
+					appName: worker.name,
+					type: "backend",
+					success: true,
+					applicationId: application.applicationId,
+					imageRef: imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				});
+				logger.log(`      ✓ ${worker.name} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(run, worker.name, error);
+				throw new BackendDeployFailed(worker.name, error);
+			}
+		}
+	}
+	let frontendFailure;
+	if (frontendApps.length > 0) {
+		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
+		for (const appName of frontendApps) {
+			ctx.signal?.throwIfAborted();
+			const app = workspace.apps[appName];
+			logger.log(`\n   🌐 Deploying ${appName}...`);
+			try {
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId, applied);
+				const dependencyUrls = {};
+				if (app.dependencies) {
+					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
+				}
+				const frontendHost = hostOf(workspace, appName, stage);
+				const envContext = {
+					app,
+					appName,
+					stage,
+					state,
+					appHostname: frontendHost,
+					frontendUrls: [],
+					userSecrets: stageSecrets ?? void 0,
+					dependencyUrls
+				};
+				const { valid, missing, resolved } = validateEnvVars(requiredOf(sniffedApps.get(appName)), envContext);
+				if (!valid) throw new MissingEnvVars(appName, missing, stage);
+				if (Object.keys(resolved).length > 0) logger.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				const publicPrefix = getPublicEnvPrefix(app.framework);
+				const buildArgs = [];
+				const publicUrlArgNames = [];
+				if (publicPrefix) {
+					for (const [key, value] of Object.entries(resolved)) if (key.startsWith(publicPrefix)) {
+						buildArgs.push(`${key}=${value}`);
+						publicUrlArgNames.push(key);
+					}
+				}
+				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
+				const imageRef$3 = imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$3}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: imageName(identity, appName),
+						appName
+					},
+					buildArgs,
+					publicUrlArgs: publicUrlArgNames,
+					...dockerRun(workspace, app, ctx)
+				});
+				built(appName, image, imageRef$3);
+				const envVars = [
+					`NODE_ENV=production`,
+					`PORT=${app.port}`,
+					`STAGE=${stage}`
+				];
+				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$3,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, frontendHost);
+				deployed(appName, {
+					appName,
+					type: app.type,
+					applicationId: application.applicationId,
+					imageRef: imageRef$3,
+					...image.digest ? { digest: image.digest } : {}
+				}, frontendHost);
+				logger.log(`      ✓ ${appName} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(run, appName, error);
+				frontendFailure ??= error;
+			}
+		}
+	}
+	logger.log("\n📋 Saving deploy state...");
+	await journal.save();
+	logger.log("   ✓ State saved");
+	if (frontendFailure !== void 0) throw new FrontendDeployFailed(frontendApps.filter((app) => run.releasing.failed.has(app)), frontendFailure);
+}
+/** Each released site answering, after its DNS. Backends were checked in `release`. */
+async function verifyDokploy(run) {
+	const { workspace, ctx } = run;
+	const sites = run.released.results.filter((result) => result.success).map((result) => result.appName).filter((app) => workspace.apps[app]?.type === "web");
+	if (sites.length === 0) return;
+	await settleDns(run, sites);
+	let failure;
+	for (const appName of sites) try {
+		await checkHealth(run, appName);
+	} catch (error) {
+		if (ctx.signal.aborted) throw ctx.signal.reason;
+		failed(run, appName, error);
+		failure ??= error;
+	}
+	if (failure !== void 0) throw new FrontendDeployFailed(sites.filter((app) => run.releasing.failed.has(app)), failure);
+}
+/**
+* An app failed to release or to answer: say so, mark it for rollback, and
+* record it in the result — over the success it was recorded as, if its
+* health is what failed.
+*/
+function failed(run, appName, error) {
+	const type = run.workspace.apps[appName]?.type ?? "backend";
+	const message = error instanceof Error ? error.message : "Unknown error";
+	logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+	const results = run.released.results;
+	const recorded = results.find((result) => result.appName === appName);
+	if (recorded) {
+		recorded.success = false;
+		recorded.error = message;
+	} else results.push({
+		appName,
+		type,
+		success: false,
+		error: message
+	});
+	run.releasing.failed.add(appName);
+	run.ctx.emit({
+		type: "app.failed",
+		app: appName,
+		error: eventError(error)
+	});
+}
+/**
+* The stage's pending migrations applied, then every seed run, in the
+* deploy's sandbox against each cluster published for them. Nothing is
+* published, and nothing runs, for a project with neither.
+*/
+async function migrate(run) {
+	const { workspace, manifest, stage, ctx } = run;
+	const { api, endpoint, migrations, declaredClusters } = run.provisioned;
+	if (migrations.size === 0) return;
+	logger.log("\n🗄️  Applying migrations and seeds...");
+	const host = serverHostname(endpoint);
+	const urls = {};
+	for (const [database, keys] of migrations) {
+		const cluster = declaredClusters[database];
+		if (!cluster) continue;
+		let published = run.published.get(database);
+		if (!published) {
+			published = await publishPostgres(api, cluster, host);
+			run.published.set(database, published);
+		}
+		for (const [key, url] of Object.entries(keys)) urls[key] = publishedUrl(url, published);
+	}
+	const ran = await runMigrations({
+		root: workspace.root,
+		stage,
+		manifest,
+		patterns: constructGlobs(workspace),
+		urls,
+		signal: ctx.signal
+	});
+	for (const { migrations: folder, applied } of ran.migrations) if (applied.length === 0) logger.log(`   ✓ ${folder}: up to date`);
+	reportDatabaseRuns(ran.migrations.map(({ construct, migrations: folder, applied }) => ({
+		construct,
+		folder,
+		applied
+	})), ran.seeds.map(({ construct, seeds: folder, seeded }) => ({
+		construct,
+		folder,
+		seeded
+	})), (line) => logger.log(`   ${line}`), (event) => ctx.emit(event));
+}
+/**
+* DNS records for `apps`' hosts, their propagation, and Dokploy's validation
+* of each domain — before anything is asked of them by name.
+*/
+async function settleDns(run, apps) {
+	const { workspace } = run;
+	const { api, endpoint, journal, state } = run.provisioned;
+	const appHostnames = new Map([...run.released.appHostnames].filter(([app]) => apps.includes(app)));
+	const dnsConfig = workspace.dns;
+	if (!dnsConfig || appHostnames.size === 0) return;
+	const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
+	if (dnsResult?.serverIp) {
+		await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
+		await journal.save();
+	}
+	if (dnsResult?.success) {
+		logger.log("\n🔒 Validating domains for SSL certificates...");
+		for (const [appName, hostname] of appHostnames) try {
+			const result = await api.validateDomain(hostname);
+			if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+			else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
+		} catch (validationError) {
+			const message = validationError instanceof Error ? validationError.message : "Unknown error";
+			logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
+		}
+	}
+}
+/**
+* Whether a released app answers: `healthyAfter` 2xx in a row from its
+* health route under its domain. An app without a domain has nothing to ask
+* by name, so Dokploy's finished deployment is its check.
+*/
+async function checkHealth(run, appName) {
+	const { workspace, verify, ctx } = run;
+	const { appHostnames, appDomainIds, applicationIds } = run.released;
+	const host = appHostnames.get(appName);
+	if (!host || !appDomainIds.has(appName)) {
+		ctx.emit({
+			type: "health.checked",
+			app: appName,
+			url: `dokploy:application.status/${applicationIds.get(appName)}`,
+			healthy: true,
+			attempt: 1
+		});
+		logger.log(`   ✓ ${appName}: no domain, so its finished deployment is its check`);
+		return;
+	}
+	const url = `https://${host}${workspace.apps[appName].type === "web" ? "/" : verify.healthCheckPath}`;
+	logger.log(`\n🩺 Checking ${appName} at ${url}...`);
+	await verifyHealth({
+		app: appName,
+		url,
+		healthyAfter: verify.healthyAfter,
+		intervalMs: verify.intervalMs,
+		timeoutMs: verify.healthTimeoutMs,
+		signal: ctx.signal,
+		emit: ctx.emit
+	});
+	logger.log(`   ✓ ${appName} healthy (${verify.healthyAfter} in a row)`);
+}
+/**
+* Point an application back at `image`, deploy it, and wait for Dokploy to
+* finish. The environment stays the newer release's: it is resolved from the
+* stage, which a rollback does not change, and holds no image of its own.
+*/
+async function restoreImage(api, options) {
+	const { applicationId, image, registryId, verify, signal } = options;
+	const since = await api.latestDeploymentAt(applicationId);
+	await api.saveDockerProvider(applicationId, image.ref, registryId ? { registryId } : void 0);
+	await api.deployApplication(applicationId);
+	await api.waitForDeployment(applicationId, {
+		since,
+		timeoutMs: verify.deploymentTimeoutMs,
+		intervalMs: verify.intervalMs,
+		signal
+	});
+}
+/**
+* Put back what ran before this run, after its `release` or `verify` failed:
+* the apps that failed — or, `atomic`, every app the run released — each
+* pointed at its previous image and redeployed. An app released for the
+* first time has nothing to go back to and is left as it is.
+*/
+async function rollbackDokploy(run, failure) {
+	const { switched, failed: failedApps } = run.releasing;
+	const apps = [...switched.keys()].filter((app) => run.atomic || failedApps.has(app));
+	if (!run.provisioned || apps.length === 0) {
+		logger.log(`\n⏪ Nothing to roll back: the ${failure.phase} failed before any app was switched.`);
+		return;
+	}
+	const { api, journal, state, registryId } = run.provisioned;
+	logger.log(`\n⏪ Rolling back ${run.atomic ? "every app this run released" : "what failed"}: ${apps.join(", ")}`);
+	for (const appName of apps) {
+		const { applicationId, before } = switched.get(appName);
+		if (!before) {
+			logger.log(`   ⚠ ${appName}: this was its first release, so there is nothing to restore`);
+			continue;
+		}
+		await restoreImage(api, {
+			applicationId,
+			image: before,
+			registryId,
+			verify: run.verify,
+			signal: run.ctx.signal
+		});
+		recordRollback(state, appName, before);
+		await journal.save();
+		logger.log(`   ✓ ${appName} rolled back to ${before.ref}`);
+	}
+}
+/** What the run did, printed as the summary it always ended with. */
+function dokployResult(run) {
+	if (run.result) return run.result;
+	const { stage, identity, imageTag } = run;
+	const { projectId, environmentId, changes } = run.provisioned;
+	const { results, publicUrls } = run.released;
+	const project = { projectId };
+	const successCount = results.filter((r) => r.success).length;
+	const failedCount = results.filter((r) => !r.success).length;
+	logger.log(`\n${"─".repeat(50)}`);
+	logger.log(`\n✅ Workspace deployment complete!`);
+	logger.log(`   Project: ${project.projectId}`);
+	logger.log(`   Successful: ${successCount}`);
+	if (failedCount > 0) logger.log(`   Failed: ${failedCount}`);
+	if (Object.keys(publicUrls).length > 0) {
+		logger.log("\n   📡 Deployed URLs:");
+		for (const [name, url] of Object.entries(publicUrls)) logger.log(`      ${name}: ${url}`);
+	}
+	return {
+		apps: results,
+		projectId: project.projectId,
+		environmentId,
+		successCount,
+		failedCount,
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		dryRun: false,
+		skipped: [...run.skipped],
+		urls: publicUrls,
+		changes
+	};
+}
+/**
+* An app's Dokploy application, through the journal: by the id recorded for
+* it, else by its name in the stage's environment, else created. Its id goes
+* into `state.applications` too, which the env resolver and `state:show` read.
+*/
+async function ensureApplication(api, journal, appName, dokployAppName, projectId, environmentId, applied) {
+	const recorded = journal.record(`application:${appName}`);
+	if (recorded?.status === "ready" && recorded.id) logger.log(`      Using cached ID: ${recorded.id}`);
+	const { resource, via, staleId } = await journal.ensure({
+		key: `application:${appName}`,
+		type: "application",
+		data: { name: dokployAppName }
+	}, {
+		get: (id) => api.getApplication(id),
+		find: () => api.findApplicationByName(projectId, dokployAppName, environmentId),
+		create: () => api.createApplication(dokployAppName, projectId, environmentId),
+		id: (application) => application.applicationId
+	});
+	if (staleId) logger.log(`      ⚠ Cached ID invalid, will create new`);
+	logger.log(`      ${{
+		recorded: "✓ Application found",
+		resumed: "Resumed application a stopped run created",
+		found: "Found existing application",
+		created: "Created application"
+	}[via]}: ${resource.applicationId}`);
+	applied({
+		key: `application:${appName}`,
+		resourceType: "application",
+		action: via === "created" ? "create" : "reuse",
+		id: resource.applicationId
+	}, via);
+	setApplicationId(journal.state, appName, resource.applicationId);
+	return resource;
+}
+/**
+* The domain `host` routes to an application, through the journal — found on
+* the application before it is created, so a re-run never adds a second.
+*
+* A domain that cannot be created is reported and skipped rather than
+* failing the app: the application is deployed and reachable on Dokploy's
+* own address, and DNS is fixed by hand more easily than a half deploy.
+*/
+async function ensureDomain(api, journal, host, port, applicationId, applied) {
+	try {
+		const { resource, via } = await journal.ensure({
+			key: `domain:${host}`,
+			type: "domain",
+			data: {
+				host,
+				applicationId
+			}
+		}, {
+			find: async () => (await api.getDomainsByApplicationId(applicationId)).find((d) => d.host === host),
+			create: () => api.createDomain({
+				host,
+				port,
+				https: true,
+				certificateType: "letsencrypt",
+				applicationId
+			}),
+			id: (domain) => domain.domainId
+		});
+		logger.log(`      ✓ Domain: https://${host} (${via === "created" ? "created" : "existing"})`);
+		applied({
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: via === "created" ? "create" : "reuse",
+			id: resource.domainId
+		}, via);
+		return resource.domainId;
+	} catch (domainError) {
+		if (domainError instanceof StateVersionConflict || domainError instanceof StateStoreBusy || isAbort(domainError)) throw domainError;
+		const message = domainError instanceof Error ? domainError.message : "Unknown error";
+		logger.log(`      ⚠ Domain creation failed: ${message}`);
+		return;
+	}
+}
+/** Whether `error` is a run being stopped rather than something failing. */
+function isAbort(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+/**
+* Where docker runs for one app: the workspace root, building from the
+* Dockerfile `gkm docker` writes for the app there.
+*/
+function dockerRun(workspace, app, ctx) {
+	return {
+		cwd: workspace.root,
+		appPath: app.path,
+		...ctx.signal ? { signal: ctx.signal } : {},
+		...ctx.stdio ? { stdio: ctx.stdio } : {}
+	};
+}
+/** The Dokploy login, from the run's provider, or `MissingCredential`. */
+async function dokployApi(workspace, ctx) {
+	const configured = workspace.deploy.dokploy?.endpoint;
+	const creds = await ctx.credentials.get({
+		kind: "dokploy",
+		...configured ? { endpoint: configured } : {}
+	}, { signal: ctx.signal });
+	if (!creds) throw new MissingCredential("dokploy", configured);
+	return {
+		api: new DokployApi({
+			baseUrl: creds.endpoint,
+			token: creds.token,
+			...ctx.signal ? { signal: ctx.signal } : {}
+		}),
+		endpoint: creds.endpoint
+	};
+}
+/** Each app's public host, the same way the deploy resolves it. */
+function hostOf(workspace, appName, stage) {
+	const app = workspace.apps[appName];
+	return resolveHost(appName, app, stage, workspace.domains, app.type === "web" && isMainFrontendApp(appName, app, workspace.apps));
+}
+/**
+* What a deploy would do, from the same lookups it starts with — and nothing
+* else: no lock, no state written, no secret generated, no Dokploy resource
+* created or changed, no image built or pushed.
+*/
+async function planDokploy(run) {
+	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity } = run;
+	const { ctx } = run;
+	logger.log("\n🔎 Dry run: nothing will be created, changed, built or pushed.");
+	const changes = [];
+	const plan = (change, detail) => {
+		changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+		const sign = change.action === "reuse" ? "=" : "+";
+		logger.log(`   ${sign} ${change.action} ${change.key} (${detail})`);
+	};
+	const { api } = await dokployApi(workspace, ctx);
+	const stored = (await run.store.read(stage))?.state;
+	const state = stored ? asDokployState(stored) : void 0;
+	const project = await findProject(api, identity, state?.projectId);
+	if (project) plan({
+		key: "project",
+		resourceType: "project",
+		action: "reuse",
+		id: project.projectId
+	}, project.needsClaim ? `${project.name}, would be claimed for ${identity.key}` : project.name);
+	else plan({
+		key: "project",
+		resourceType: "project",
+		action: "create"
+	}, projectName(identity));
+	const environment = project?.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
+	plan(environment ? {
+		key: "environment",
+		resourceType: "environment",
+		action: "reuse",
+		id: environment.environmentId
+	} : {
+		key: "environment",
+		resourceType: "environment",
+		action: "create"
+	}, stage);
+	let registryPlanned;
+	const registry = await resolveRegistry(api, {
+		stage,
+		registry: workspace.deploy.registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state?.registryId,
+		log: (message) => logger.log(message),
+		create: async (url) => {
+			registryPlanned = {
+				key: "registry",
+				resourceType: "registry",
+				action: "create"
+			};
+			return {
+				registryId: "",
+				registryName: url
+			};
+		}
+	});
+	plan(registryPlanned ?? {
+		key: "registry",
+		resourceType: "registry",
+		action: "reuse",
+		id: registry.registryId
+	}, registry.registryName);
+	for (const [id, declaration] of Object.entries(manifest)) plan({
+		key: `construct:${id}`,
+		resourceType: declaration.kind,
+		action: "ensure"
+	}, declaration.kind);
+	reportPlannedSeeds((await plannedSeeds({
+		root: workspace.root,
+		manifest
+	})).map(({ target, seeds }) => ({
+		folder: target.seeds,
+		seeds
+	})), (line) => logger.log(`   ${line}`));
+	const apps = [];
+	const urls = {};
+	for (const appName of appsToDeployNames) {
+		const app = workspace.apps[appName];
+		if (app.type === "mobile") continue;
+		const dokployAppName = applicationName(identity, appName);
+		const recordedId = state?.applications?.[appName];
+		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
+		plan(existing ? {
+			key: `application:${appName}`,
+			resourceType: "application",
+			action: "reuse",
+			id: existing.applicationId
+		} : {
+			key: `application:${appName}`,
+			resourceType: "application",
+			action: "create"
+		}, dokployAppName);
+		const ref = imageRef(identity, appName, workspace.deploy.registry, imageTag);
+		plan({
+			key: `image:${appName}`,
+			resourceType: "image",
+			action: "build"
+		}, ref);
+		const host = hostOf(workspace, appName, stage);
+		const domain = existing ? (await api.getDomainsByApplicationId(existing.applicationId)).find((d) => d.host === host) : void 0;
+		plan(domain ? {
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: "reuse",
+			id: domain.domainId
+		} : {
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: "create"
+		}, `https://${host}`);
+		urls[appName] = `https://${host}`;
+		apps.push({
+			appName,
+			type: app.type,
+			success: true,
+			imageRef: ref,
+			url: urls[appName],
+			...existing ? { applicationId: existing.applicationId } : {}
+		});
+	}
+	for (const worker of run.workers) {
+		const dokployAppName = applicationName(identity, worker.name);
+		const recordedId = state?.applications?.[worker.name];
+		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
+		plan(existing ? {
+			key: `application:${worker.name}`,
+			resourceType: "application",
+			action: "reuse",
+			id: existing.applicationId
+		} : {
+			key: `application:${worker.name}`,
+			resourceType: "application",
+			action: "create"
+		}, `${dokployAppName}, worker ${worker.id} — no domain`);
+		const ref = imageRef(identity, worker.name, workspace.deploy.registry, imageTag);
+		plan({
+			key: `image:${worker.name}`,
+			resourceType: "image",
+			action: "build"
+		}, ref);
+		apps.push({
+			appName: worker.name,
+			type: "backend",
+			success: true,
+			imageRef: ref,
+			...existing ? { applicationId: existing.applicationId } : {}
+		});
+	}
+	const creates = changes.filter((c) => c.action !== "reuse").length;
+	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
+	run.result = {
+		apps,
+		projectId: project?.projectId ?? "",
+		environmentId: environment?.environmentId ?? "",
+		successCount: apps.length,
+		failedCount: 0,
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		dryRun: true,
+		skipped: [...run.skipped],
+		urls,
+		changes
+	};
+}
+/** Why a mobile app is left out of a Dokploy deploy. */
+const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
+//#endregion
+export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
+
+//# sourceMappingURL=engine-32gL2ju3.mjs.map