@geekmidas/cli 10.0.0-alpha.59 → 10.0.0-alpha.60

package/dist/deploy-0fBVeWO-.cjs

@@ -0,0 +1,3518 @@
+const require_sniffer = require("./sniffer-DIv12ncU.cjs");
+const require_home = require("./home-DOzBaWaL.cjs");
+const require_discover = require("./discover-Bc-4eA_p.cjs");
+const require_config = require("./config-DXnkCEq0.cjs");
+const require_workspace = require("./workspace-B64Xk1Mb.cjs");
+const require_storage = require("./storage-CSGoC3bK.cjs");
+const require_store = require("./store-KvNQwYaB.cjs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_crypto = require("node:crypto");
+let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
+let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
+let pg = require("pg");
+let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
+let node_dns_promises = require("node:dns/promises");
+//#region src/deploy/credentials.ts
+/**
+* How a deploy gets the credentials it acts with.
+*
+* `deploy()` never prompts and never reads a terminal: it asks a
+* `CredentialProvider` and, when the provider has nothing, stops with
+* `MissingCredential` naming what it needed and how to supply it. Whether to
+* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
+* prompts at a terminal and stores what was typed; a CI job sets the
+* environment; a host passes its own provider.
+*/
+/** How to supply each kind, for the error that says it is missing. */
+const HOW_TO_PROVIDE = {
+	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
+	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
+};
+/** A deploy needed a credential, and its provider had none. */
+var MissingCredential = class extends Error {
+	kind;
+	target;
+	howToProvide;
+	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind]) {
+		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.`;
+		super(`${what} ${howToProvide}`);
+		this.kind = kind;
+		this.target = target;
+		this.howToProvide = howToProvide;
+		this.name = "MissingCredential";
+	}
+};
+/** Whatever was asked for, from the first provider that has it. */
+function chainCredentials(...providers) {
+	return { async get(request, options) {
+		for (const provider of providers) {
+			const found = await provider.get(request, options);
+			if (found) return found;
+		}
+	} };
+}
+/**
+* Credentials from the environment, then from what `gkm login` stored. What
+* `deploy()` uses when it is handed no provider.
+*
+* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
+*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
+*   Each half is read on its own: a token is a secret and belongs in the
+*   environment, an endpoint is configuration and belongs in the config.
+* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+*/
+function storedCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	return { async get(asked) {
+		const request = asked;
+		switch (request.kind) {
+			case "dokploy": {
+				const stored = (await require_sniffer.readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
+				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
+				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
+				if (!token || !endpoint) return void 0;
+				return {
+					endpoint: endpoint.replace(/\/$/, ""),
+					token
+				};
+			}
+			case "registry": {
+				const username = env.DOCKER_REGISTRY_USERNAME;
+				const password = env.DOCKER_REGISTRY_PASSWORD;
+				if (!username || !password) return void 0;
+				return {
+					username,
+					password
+				};
+			}
+		}
+	} };
+}
+//#endregion
+//#region src/deploy/events.ts
+/** An error as an event carries it: its name and message, nothing else. */
+function eventError(error) {
+	if (error instanceof Error) return {
+		name: error.name,
+		message: error.message
+	};
+	return {
+		name: "Error",
+		message: String(error)
+	};
+}
+//#endregion
+//#region src/deploy/fromManifest.ts
+/**
+* The Dokploy target, read off the construct manifest.
+*
+* The AWS target has done this since `fromManifest` landed: a table keyed by
+* declaration kind, each entry turning one declaration into infrastructure and
+* the env keys it resolves. Dokploy had no such thing — it resolved environment
+* from the *sniffer*, which walks application code for `get('X')` calls, and a
+* construct reads its own key inside `@geekmidas/constructs` where there is
+* nothing to find. So a declared app deployed here got none of the model, and
+* nothing reported the absence: the deploy succeeded and the first request that
+* needed a URL failed at runtime.
+*
+* This is the same table, over the REST wrapper instead of over Pulumi.
+*
+* **Two phases, and the split is not incidental.** Creating a Postgres and
+* creating a role inside it are different kinds of act: the first is an API
+* call, the second needs a connection to a database that does not exist yet
+* when the call is made. So provisioners *accumulate* DDL rather than running
+* it, and it is applied once against a cluster that is up — which is exactly
+* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+*
+* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
+* the same generators the local target and the AWS target use. Dokploy used to
+* write its own `DO $$` block, which meant three targets applying three
+* different definitions of "the role split" and no way to notice they had
+* drifted.
+*
+* Entries are deliberately small and free of I/O ordering: each takes what it
+* needs and returns what it resolved. That is what would let a Pulumi dynamic
+* provider wrap one later without the table itself changing — see §6b.
+*/
+/**
+* The internal hostname a Dokploy Postgres answers on.
+*
+* Its own service name on the Docker network — not the server's public address.
+* An app reaching its database over the public internet would be a credential
+* crossing a network that did not need to see it.
+*/
+function clusterHost(postgres) {
+	return postgres.appName;
+}
+/**
+* What a resource is called in the provider.
+*
+* `cloudName` and nothing else — the same scoped kebab rule the AWS target
+* uses, so a name reads identically on both: `production-shop-orders`.
+*
+* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
+* is one flat list where an application and its database would collide. It is
+* not: `project.one` returns typed collections — `applications`, `postgres`,
+* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
+* the shape of the response and an application and a Postgres of the same name
+* are different objects with different ids. The suffix was answering a question
+* nobody had asked.
+*/
+function serviceName(scope, id) {
+	return (0, _geekmidas_manifest.cloudName)(scope, id);
+}
+const PROVISIONERS = {
+	/**
+	* A Postgres service, plus the roles that reach it.
+	*
+	* The service is `findOrCreate`, because a deploy that recreated the
+	* database would be a deploy that lost the data. The roles are deferred:
+	* they need a connection to a cluster this call has only just asked for.
+	*/
+	database: async (declaration, context) => {
+		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
+		const name = require_sniffer.resourceName(declaration.id, declaration.kind, context.stage);
+		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id), context.projectId, context.environmentId, {
+			databaseName: name,
+			databasePassword: derivedPassword(context, `${name}:master`)
+		});
+		const host = clusterHost(postgres);
+		context.clusters[postgres.databaseName] = postgres;
+		const schema = declaration.schema ?? "app";
+		const runtime = name;
+		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: postgres.databaseName,
+			ownsDatabase: true,
+			runtime,
+			owner,
+			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
+			schema,
+			context
+		}));
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
+		} };
+	},
+	/**
+	* A schema in the parent's database, with its own role and its own URL — so
+	* the parent's role holds no grant on these tables at all.
+	*/
+	"database-schema": async (declaration, context) => {
+		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const runtime = require_sniffer.resourceName(declaration.id, declaration.kind, context.stage);
+		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: parentUrl.pathname.slice(1),
+			runtime,
+			owner,
+			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
+			schema: declaration.schema,
+			context
+		}));
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
+		} };
+	},
+	/**
+	* A read-only endpoint on the same cluster.
+	*
+	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
+	* resolves to the writer's address — and that is safe rather than a
+	* loophole, because read-only is enforced by the reader role's grants and
+	* not by which host the URL names. The role itself was created with its
+	* parent.
+	*/
+	"database-reader": async (declaration, context) => {
+		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
+		const reader = (0, _geekmidas_db_pg_roles.readerRole)(parentUrl.username);
+		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
+	},
+	/**
+	* A cache, wherever the project said it lives.
+	*
+	* `db` is a table in a database the manifest already declares, so it
+	* provisions no service and costs nothing to run — the same relationship
+	* pg-boss has. The table's DDL is deferred with the roles, and the table
+	* name travels in the URL because two caches in one database resolve the
+	* same connection string.
+	*/
+	cache: async (declaration, context) => {
+		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
+		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
+		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
+		const parent = context.provisioned[parentId];
+		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
+		const parentUrl = parent.provides[(0, _geekmidas_manifest.provideKey)(parentId, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
+		const table = declaration.table ?? (0, _geekmidas_manifest.cacheTable)(declaration.id);
+		const schema = schemaOf(context.manifest, parentId);
+		const qualified = schema ? `${schema}.${table}` : table;
+		context.deferred.push(...(0, _geekmidas_cache_postgres.cacheTableStatements)({ table: qualified }).map((statement) => ({
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: statement.describe,
+			sql: statement.sql,
+			...statement.exists ? { exists: statement.exists } : {}
+		})), {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${qualified} is owned by its schema's owner`,
+			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted((0, _geekmidas_db_pg_roles.ownerRole)(new URL(parentUrl).username))}`
+		}, {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
+			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
+		});
+		const url = new URL(parentUrl);
+		url.searchParams.set("table", table);
+		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url.toString() } };
+	},
+	/**
+	* A bucket, as a MinIO stack on the box.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* object storage, so this is the one kind whose infrastructure this target
+	* *writes* rather than configures — a compose file with one service in it.
+	*
+	* The service is named `cloudName(...)` like everything else, which is not
+	* cosmetic here: containers on `dokploy-network` resolve each other by
+	* service name, so the name is the address. Calling it `minio` would work
+	* for exactly one project on the box and then collide.
+	*
+	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
+	* reads them from an execution role, so a URL that embedded a key would be
+	* one more thing to rotate and leak. There is no role here, so the same
+	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
+	* locally.
+	*/
+	objects: async (declaration, context) => {
+		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const backend = context.storage ?? "minio";
+		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const bucket = require_sniffer.resourceName(declaration.id, declaration.kind, context.stage);
+		const user = `${bucket}-root`;
+		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
+			service,
+			bucket,
+			user,
+			password
+		}));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: s3Url(service, bucket),
+			AWS_ACCESS_KEY_ID: user,
+			AWS_SECRET_ACCESS_KEY: password,
+			AWS_REGION: MINIO_REGION
+		} };
+	},
+	/**
+	* The address a bucket's objects are served on.
+	*
+	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
+	* behind the first would terminate TLS twice — which is why the local
+	* target's Caddy has no equivalent here. What this resolves is the address,
+	* and the `open` prefixes are applied to the bucket rather than to an edge,
+	* so a policy is what makes them public wherever the bucket lives.
+	*
+	* Until a Traefik rule exists it answers on MinIO directly, path-style,
+	* which is honest about the shape it has today: the bucket is in the path
+	* rather than fronted by a host of its own.
+	*/
+	"file-server": async (declaration, context) => {
+		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const parentUrl = context.provisioned[declaration.of]?.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
+		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
+		const bucket = new URL(parentUrl).hostname;
+		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
+		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* A topic, and below it a queue — the same broker either way.
+	*
+	* Under pg-boss there is nothing to create in Dokploy: the broker is a
+	* schema tenant of the database the app already declared, exactly as it is
+	* locally, so what this resolves is an address rather than a service. Which
+	* is the point of putting the backend in config — the same handlers drain
+	* pg-boss here and SQS on AWS because the string they were handed said so.
+	*
+	* The tenant gets its own role rather than the cluster master, for the
+	* reason every other tenant does: pg-boss creates and owns its tables, and
+	* a broker that could also read the application's is a broker with a grant
+	* nothing asked for.
+	*/
+	topic: async (declaration, context) => {
+		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	queue: async (declaration, context) => {
+		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	/**
+	* A signing key, generated once and remembered in the stage's store.
+	*
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
+	*/
+	secret: async (declaration, context) => {
+		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
+		const key = declaration.provides?.[0];
+		if (!key) return { provides: {} };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: (0, _geekmidas_manifest.externalApiUrl)(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
+	},
+	/**
+	* A surface, at the address whatever created its domain assigned.
+	*
+	* Nothing is provisioned here: the application and its domain are the
+	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
+	* Encrypt certificate. What this adds is the *derivation* — who may call it,
+	* and where a cookie it sets is readable — from the graph rather than from a
+	* hand-maintained list.
+	*/
+	"rest-api": async (declaration, context) => {
+		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
+		const url = context.addresses?.[declaration.id];
+		if (!url) throw new SurfaceHasNoAddress(declaration.id);
+		const origins = [...new Set((0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
+		const domain = (0, _geekmidas_manifest.cookieDomain)([url, ...origins]);
+		const schemes = (0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? (0, _geekmidas_manifest.mobileOrigins)((0, _geekmidas_manifest.schemeBase)(context.project, app.scheme)) : [];
+		});
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url,
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
+			...domain ? { [(0, _geekmidas_manifest.provideKey)(declaration.id, "cookieDomain")]: domain } : {}
+		} };
+	}
+};
+/** The provisioner for a kind, or nothing where this target has none yet. */
+function provisionerFor(kind) {
+	return PROVISIONERS[kind];
+}
+/**
+* The role DDL for one database or tenant, from the shared generator.
+*
+* The same statements the local target applies and the same ones the AWS
+* bootstrap runs. Dokploy used to write its own, which is how three targets
+* came to hold three definitions of the same split.
+*/
+function statementsFor(options) {
+	const { id, database, runtime, owner, reader, schema, context } = options;
+	return (0, _geekmidas_db_pg_roles.roleStatements)({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		...options.ownsDatabase ? { database } : {},
+		passwords: {
+			runtime: derivedPassword(context, runtime),
+			owner: derivedPassword(context, owner),
+			...reader ? { reader: derivedPassword(context, reader) } : {}
+		}
+	}).map((statement) => ({
+		...statement,
+		id,
+		database
+	}));
+}
+/**
+* The connection string a declared queue or topic publishes on.
+*
+* One broker for the whole project, which is what the local target does and
+* what the runtime expects: the generated pollers open a single connection and
+* subscribe each worker by name on it. So every carrier resolves to the same
+* address, and the DDL that backs it is pushed once however many are declared.
+*
+* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
+* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
+* the §4.3 question, and composing a plausible URL for either would fail at the
+* first publish instead of here.
+*/
+function broker(id, context) {
+	const backend = context.events ?? "pgboss";
+	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
+	const parentId = soleDatabase(context);
+	if (!parentId) throw new BrokerNeedsADatabase(id);
+	const parentUrl = context.provisioned[parentId]?.provides[(0, _geekmidas_manifest.provideKey)(parentId, "url")];
+	if (!parentUrl) throw new UnresolvedParent(id, parentId);
+	const url = new URL(parentUrl);
+	const database = url.pathname.slice(1);
+	const runtime = `${database}_${PGBOSS_SCHEMA}`;
+	const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
+	if (!context.provisioned[BROKER_ID]) {
+		context.deferred.push(...statementsFor({
+			id: BROKER_ID,
+			database,
+			runtime,
+			owner,
+			schema: PGBOSS_SCHEMA,
+			context
+		}));
+		context.provisioned[BROKER_ID] = { provides: {} };
+	}
+	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
+	return { provides: { [(0, _geekmidas_manifest.provideKey)(id, "publisherConnectionString")]: connection } };
+}
+/** The schema pg-boss creates its tables in, here as locally. */
+const PGBOSS_SCHEMA = "pgboss";
+/**
+* The id the broker's DDL is pushed under.
+*
+* Not a construct — no declaration names it — but the deferred statements need
+* an id, and every carrier in the project shares this one.
+*/
+const BROKER_ID = "PgBoss";
+/**
+* A pg-boss address: a Postgres URL under a scheme that picks the transport.
+*
+* The protocol is what a producer branches on, so it never branches — the same
+* `.publish()` reaches pg-boss here and SQS on AWS.
+*/
+function pgbossUrl(role, password, host, database) {
+	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
+}
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
+/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
+function s3Url(service, bucket) {
+	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
+}
+/**
+* A one-service compose file for a bucket.
+*
+* `dokploy-network` is external and already exists — it is what every Dokploy
+* service is attached to, and joining it is what makes the app able to resolve
+* this one by name. The bucket itself is created by MinIO's entrypoint rather
+* than by a second call, so there is nothing to reconcile afterwards.
+*/
+function minioCompose(options) {
+	const { service, bucket, user, password } = options;
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+		`    command: server /data --console-address ":9001"`,
+		"    environment:",
+		`      MINIO_ROOT_USER: ${user}`,
+		`      MINIO_ROOT_PASSWORD: ${password}`,
+		"    volumes:",
+		`      - ${service}-data:/data`,
+		"    networks:",
+		"      - dokploy-network",
+		"    healthcheck:",
+		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
+		"      interval: 10s",
+		"      retries: 5",
+		`  ${service}-bucket:`,
+		"    image: minio/mc:latest",
+		"    depends_on:",
+		`      ${service}:`,
+		"        condition: service_healthy",
+		"    entrypoint: >",
+		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
+		`      mc mb --ignore-existing s3/${bucket}"`,
+		"    networks:",
+		"      - dokploy-network",
+		"volumes:",
+		`  ${service}-data:`,
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/** Whether anything reads through a reader on this construct. */
+function readsFrom(manifest, id) {
+	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
+}
+/** The schema a database or tenant pins on its roles. */
+function schemaOf(manifest, id) {
+	const declaration = manifest[id];
+	if (declaration?.kind === "database") return declaration.schema ?? "app";
+	if (declaration?.kind === "database-schema") return declaration.schema;
+}
+/**
+* The one declared database, where `cache: 'db'` has to pick.
+*
+* Unambiguous with one and arbitrary with two, so two is an error rather than a
+* coin toss — a cache landing in a database nobody chose surfaces as entries
+* that are never found, long after the deploy reported success.
+*/
+function soleDatabase(context) {
+	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
+	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
+	return databases[0];
+}
+/**
+* A password derived from the stage's seed, the project, the stage and the role.
+*
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
+*/
+function derivedPassword(context, role) {
+	return (0, node_crypto.createHash)("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/** A connection string for a role on a cluster. */
+function postgresUrl(role, password, host, database) {
+	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
+}
+/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
+function quoted(name) {
+	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
+}
+/** A provisioner was handed a declaration of the wrong kind. */
+/**
+* A value only the stage's own secrets can hold.
+*
+* @throws {MissingSuppliedSecret} when the stage was never given it.
+*/
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
+}
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends Error {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
+var WrongKind = class extends Error {
+	kind;
+	constructor(kind) {
+		super(`No Dokploy provisioner handles '${kind}'`);
+		this.kind = kind;
+		this.name = "WrongKind";
+	}
+};
+/** A derived construct whose parent has not been provisioned. */
+var UnresolvedParent = class extends Error {
+	id;
+	parent;
+	constructor(id, parent) {
+		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
+		this.id = id;
+		this.parent = parent;
+		this.name = "UnresolvedParent";
+	}
+};
+/** A cache with nowhere to live. */
+var CacheNeedsAHome = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
+		this.id = id;
+		this.backend = backend;
+		this.name = "CacheNeedsAHome";
+	}
+};
+/** A `'db'` cache (a server target's default) with more than one database. */
+var CacheIsAmbiguous = class extends Error {
+	databases;
+	constructor(databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+/** A surface reached provisioning before its domain existed. */
+var SurfaceHasNoAddress = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
+		this.id = id;
+		this.name = "SurfaceHasNoAddress";
+	}
+};
+/** A queue or topic on a backend this target has no primitive for. */
+var UnprovisionableCarrier = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableCarrier";
+	}
+};
+/** A pg-boss carrier in an app that declares no database to host it. */
+var BrokerNeedsADatabase = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
+		this.id = id;
+		this.name = "BrokerNeedsADatabase";
+	}
+};
+/** A bucket on a backend this target has no primitive for. */
+var UnprovisionableBucket = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableBucket";
+	}
+};
+//#endregion
+//#region src/deploy/declared.ts
+/**
+* The declared half of a Dokploy deploy.
+*
+* `fromManifest.ts` decides what each construct resolves to; this runs it —
+* discovers the manifest, walks it parents-first, and applies the DDL the
+* provisioners deferred.
+*
+* It is deliberately separate from the engine in `index.ts`. That file deploys
+* *applications*: images, registries, domains, the things a project has whether
+* or not it declares anything. This is the part that exists because the app
+* declared it, and keeping the two apart is what lets a project adopt the model
+* without rewriting its deploy — and lets this one be tested without one.
+*/
+/**
+* Provision everything the workspace declares, and return what it resolved.
+*/
+async function provisionDeclared(options) {
+	const { workspace } = options;
+	const empty = {
+		env: {},
+		statements: [],
+		provisioned: {},
+		clusters: {}
+	};
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: require_sniffer.constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	if (Object.keys(manifest).length === 0) return empty;
+	const context = {
+		manifest,
+		provisioned: {},
+		api: options.api,
+		projectId: options.projectId,
+		environmentId: options.environmentId,
+		stage: options.stage,
+		project: workspace.name,
+		scope: options.scope ?? workspace.name,
+		cache: require_sniffer.cacheBackendFor(require_sniffer.providerOf(workspace)),
+		events: require_sniffer.eventsBackendFor(require_sniffer.providerOf(workspace)),
+		storage: require_sniffer.storageBackendFor(require_sniffer.providerOf(workspace)),
+		addresses: surfaceAddresses(manifest, options.appUrls),
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
+		deferred: [],
+		clusters: {}
+	};
+	const env = {};
+	for (const id of carriersLast((0, _geekmidas_manifest.provisionOrder)(manifest), manifest)) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const provisioner = provisionerFor(declaration.kind);
+		if (!provisioner) continue;
+		const result = await provisioner(declaration, context);
+		context.provisioned[id] = result;
+		Object.assign(env, result.provides);
+	}
+	return {
+		env,
+		statements: context.deferred.map((statement) => ({
+			id: statement.id,
+			describe: statement.describe,
+			...statement.database ? { database: statement.database } : {},
+			...statement.exists ? { exists: statement.exists } : {},
+			create: statement.sql
+		})),
+		provisioned: context.provisioned,
+		clusters: context.clusters
+	};
+}
+/**
+* Run the deferred DDL against a cluster that is now reachable.
+*
+* The same applier the local target uses: every statement asks whether it is
+* needed first, so a redeploy is free and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclared(client, statements) {
+	return (await require_sniffer.applyPostgres(client, statements)).filter((entry) => entry.created).length;
+}
+/**
+* The provisioning order, with queues and topics moved to the end.
+*
+* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
+* *derived from* a database, because under SNS it does not live in one. Where
+* it lives is a fact about the backend, which is config — so the dependency is
+* real under pg-boss and absent under SNS, and writing it into the declaration
+* would state it in the one place that cannot know.
+*
+* Here it can. This runs where the backend is known, and the rule needs no
+* branch on it: nothing depends on a carrier. A queue's worker and a topic's
+* subscribers are *bound* to it rather than dependent on it, which is why
+* neither holds a key of its own — so a carrier can always go last, and under
+* pg-boss that is exactly late enough for the database it reads to be there.
+*/
+function carriersLast(ordered, manifest) {
+	const carries = (id) => {
+		const kind = manifest[id]?.kind;
+		return kind === "queue" || kind === "topic";
+	};
+	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
+}
+/**
+* Where each declared surface answers: its own app's address.
+*
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
+*/
+function surfaceAddresses(manifest, appUrls) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[require_config.appKey(id)];
+		if (url) addresses[id] = url;
+	}
+	return addresses;
+}
+//#endregion
+//#region src/deploy/state.ts
+/**
+* Deploy state management for Dokploy deployments
+*
+* Stores resource IDs (applications, services) per stage to avoid
+* re-creating resources on subsequent deploys.
+*/
+/**
+* Create a new empty state for a stage
+*/
+function createEmptyState(stage, projectId, environmentId) {
+	return {
+		provider: "dokploy",
+		stage,
+		projectId,
+		environmentId,
+		applications: {},
+		services: {},
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Set application ID in state (mutates state)
+*/
+function setApplicationId(state, appName, applicationId) {
+	state.applications[appName] = applicationId;
+}
+/**
+* Record the image an app was deployed with (mutates state)
+*/
+function setDeployedImage(state, appName, image) {
+	state.images = {
+		...state.images,
+		[appName]: image
+	};
+}
+/**
+* Get a generated secret for an app
+*/
+function getGeneratedSecret(state, appName, secretName) {
+	return state?.generatedSecrets?.[appName]?.[secretName];
+}
+/**
+* Set a generated secret for an app (mutates state)
+*/
+function setGeneratedSecret(state, appName, secretName, value) {
+	if (!state.generatedSecrets) state.generatedSecrets = {};
+	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
+	state.generatedSecrets[appName][secretName] = value;
+}
+/**
+* Set DNS verification record for a hostname (mutates state)
+*/
+function setDnsVerification(state, hostname, serverIp) {
+	if (!state.dnsVerified) state.dnsVerified = {};
+	state.dnsVerified[hostname] = {
+		serverIp,
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Check if a hostname is already verified with the given IP
+*/
+function isDnsVerified(state, hostname, serverIp) {
+	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
+}
+/**
+* Get the key for a DNS record in state
+*/
+function getDnsRecordKey(name, type) {
+	return `${name}:${type}`;
+}
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Get backup state from state
+*/
+function getBackupState(state) {
+	return state?.backups;
+}
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
+}
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
+}
+//#endregion
+//#region src/deploy/dns/DnsProvider.ts
+/**
+* Check if value is a DnsProvider implementation.
+*/
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+}
+/**
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
+*/
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BTZd2u0f.cjs"));
+		return new HostingerProvider();
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-DVILBsvV.cjs"));
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
+		});
+	}
+	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
+	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
+}
+//#endregion
+//#region src/deploy/dns/index.ts
+/**
+* DNS orchestration for deployments
+*
+* Handles automatic DNS record creation for deployed applications.
+*/
+const logger$3 = require_discover.output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
+}
+/**
+* Normalize DNS config to new multi-domain format
+*/
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
+	}
+	return config;
+}
+/**
+* Find the root domain for a hostname from available DNS configs
+*
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
+*/
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
+}
+/**
+* Group hostnames by their root domain
+*/
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$3.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
+	}
+	return grouped;
+}
+/**
+* Resolve IP address from a hostname
+*/
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await (0, node_dns_promises.lookup)(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
+*/
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
+}
+/**
+* Generate required DNS records for a deployment
+*/
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
+}
+/**
+* Print DNS records table
+*/
+function printDnsRecordsTable(records, rootDomain) {
+	logger$3.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$3.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$3.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$3.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$3.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+	}
+	logger$3.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+}
+/**
+* Print DNS records in a simple format for manual setup
+*/
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$3.log("\n   📋 Required DNS Records:");
+	logger$3.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$3.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$3.log("");
+}
+/**
+* Create DNS records for a single domain using its configured provider
+*/
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$3.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
+	}
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
+	try {
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$3.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
+	}
+	return results;
+}
+/**
+* Main DNS orchestration function for deployments
+*
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+*
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
+*/
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$3.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$3.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$3.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
+	}
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$3.log("   No DNS records needed (no hostnames match configured domains)");
+		return {
+			records: [],
+			success: true,
+			serverIp
+		};
+	}
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$3.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
+		}
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$3.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$3.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$3.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$3.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+	}
+	return {
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
+	};
+}
+/**
+* Verify DNS records resolve correctly after deployment.
+*
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
+*/
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$3.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (isDnsVerified(state, hostname, serverIp)) {
+			logger$3.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				setDnsVerification(state, hostname, serverIp);
+				logger$3.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$3.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$3.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
+			});
+		}
+	}
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$3.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$3.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$3.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
+}
+//#endregion
+//#region src/deploy/docker.ts
+const logger$2 = require_discover.output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
+	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
+	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
+	await (0, node_fs_promises.chmod)(path, 384);
+	return {
+		path,
+		cleanup: () => (0, node_fs_promises.rm)(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
+	logger$2.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$2.log("   Generating Dockerfile for the pre-built bundle...");
+	await require_sniffer.dockerCommand({
+		slim: true,
+		cwd
+	});
+	const dockerfilePath = (0, node_path.join)(cwd, ".gkm", "docker", "Dockerfile");
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await require_sniffer.run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs,
+			credentialsFile: secret?.path
+		}), {
+			cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$2.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new require_sniffer.DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$2.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await require_sniffer.run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$2.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new require_sniffer.DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await require_sniffer.runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = require_sniffer.validateImageRef(getImageRef(config.registry, imageName, tag));
+	const docker = {
+		cwd: options.cwd ?? process.cwd(),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$2.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$2.log("\n✅ Docker deployment ready!");
+	logger$2.log(`\n📋 Deployment details:`);
+	logger$2.log(`   Image: ${imageRef}`);
+	logger$2.log(`   Stage: ${stage}`);
+	if (masterKey) logger$2.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
+//#region src/deploy/env-resolver.ts
+/**
+* Environment Variable Resolution for Dokploy Deployments
+*
+* Resolves sniffed environment variables to actual values during deployment.
+* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
+* and falls back to user-provided secrets.
+*/
+/**
+* Generate a secure random secret (64 hex characters = 32 bytes)
+*/
+function generateSecret() {
+	return (0, node_crypto.randomBytes)(32).toString("hex");
+}
+/**
+* Get or generate a secret for an app.
+* If the secret already exists in state, returns it.
+* Otherwise generates a new one and stores it.
+*/
+function getOrGenerateSecret(state, appName, secretName) {
+	const existing = getGeneratedSecret(state, appName, secretName);
+	if (existing) return existing;
+	const generated = generateSecret();
+	setGeneratedSecret(state, appName, secretName, generated);
+	return generated;
+}
+/**
+* Resolve a single environment variable
+*/
+function resolveEnvVar(varName, context) {
+	switch (varName) {
+		case "PORT": return String(context.app.port);
+		case "NODE_ENV": return "production";
+		case "STAGE": return context.stage;
+		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
+		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
+		case "BETTER_AUTH_TRUSTED_ORIGINS":
+			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
+			break;
+		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
+	}
+	if (context.dependencyUrls && varName.endsWith("_URL")) {
+		const depName = (require_workspace.stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
+		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
+	}
+	if (context.userSecrets) {
+		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
+		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
+		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
+		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
+	}
+}
+/**
+* Resolve all environment variables for an app
+*/
+function resolveEnvVars(requiredVars, context) {
+	const resolved = {};
+	const missing = [];
+	for (const varName of requiredVars) {
+		const value = resolveEnvVar(varName, context);
+		if (value !== void 0) resolved[varName] = value;
+		else missing.push(varName);
+	}
+	return {
+		resolved,
+		missing
+	};
+}
+/**
+* Format missing variables error message
+*/
+function formatMissingVarsError(appName, missing, stage) {
+	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+}
+/**
+* Validate that all required environment variables can be resolved
+*/
+function validateEnvVars(requiredVars, context) {
+	const { resolved, missing } = resolveEnvVars(requiredVars, context);
+	return {
+		valid: missing.length === 0,
+		missing,
+		resolved
+	};
+}
+//#endregion
+//#region src/deploy/generated.ts
+/**
+* The values a deployed stage generates once and keeps: what nothing can
+* provision and nobody else issues.
+*
+* - **A seed**, which salts every password a deploy derives — a database's
+*   master and roles, a bucket's root user. Derived from repo facts alone
+*   (project, stage, construct id), those passwords were computable by anyone
+*   who could read the repo.
+* - **Each `secret` construct's value** — an auth server's signing secret —
+*   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
+*
+* Both are generated on the first deploy that needs them and written to the
+* stage's store, so every later deploy reads the same values: sessions survive
+* a redeploy, and a role's password does not move. A value set by hand with
+* `gkm secrets:set` is kept, never replaced.
+*/
+/**
+* The stage's secrets with its seed and every declared `secret`'s value
+* present, generating what is missing. Pure: the caller writes the result
+* back to the stage's store when `generated` is not empty.
+*/
+function withGeneratedSecrets(secrets, manifest) {
+	const generated = [];
+	const custom = { ...secrets.custom };
+	for (const declaration of Object.values(manifest)) {
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
+		const key = declaration.provides?.[0];
+		if (!key || custom[key]) continue;
+		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
+		generated.push(key);
+	}
+	const seed = secrets.seed ?? random();
+	if (!secrets.seed) generated.push("seed");
+	return {
+		secrets: generated.length ? {
+			...secrets,
+			seed,
+			custom,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : secrets,
+		generated
+	};
+}
+/** 256 bits, URL-safe. */
+function random() {
+	return (0, node_crypto.randomBytes)(32).toString("base64url");
+}
+//#endregion
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
+	stage;
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
+		this.stage = stage;
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	/**
+	* The stage's journal — its stored state, or `initial` written as the
+	* stage's first state, so there is somewhere to record the very first
+	* resource before it is created.
+	*/
+	static async open(store, stage, initial) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
+		});
+	}
+	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
+		});
+	}
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
+		}
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
+		}
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
+		};
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	}
+};
+//#endregion
+//#region src/deploy/ownership.ts
+/**
+* Which Dokploy project a deploy is allowed to deploy into.
+*
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
+*/
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof require_sniffer.DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The project this identity owns, if there is one — read only, so a dry run
+* asks the same question a deploy does:
+*
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project.
+* 2. One with this name *and* this identity's marker.
+*
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
+*/
+async function findProject(api, identity, stateProjectId) {
+	const name = require_store.projectName(identity);
+	const marker = require_store.ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = require_store.markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				description: known.description ?? null,
+				environments: known.environments ?? [],
+				via: "state",
+				needsClaim: !claimed
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && require_store.isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			description: owned.description ?? null,
+			environments: details.environments ?? [],
+			via: "marker",
+			needsClaim: false
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, require_store.markerOf(clash.description));
+	return null;
+}
+/**
+* The project this deploy deploys into: the one {@link findProject} finds —
+* claimed with this identity's marker if it carries none yet, so the next
+* deploy without state still finds it — or a new one, marked.
+*/
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const marker = require_store.ownershipMarker(identity);
+	const found = await findProject(api, identity, stateProjectId);
+	if (found) {
+		if (found.needsClaim) {
+			await api.updateProject(found.projectId, {
+				name: found.name,
+				description: withMarker(found.description, marker)
+			});
+			log(`   Claimed project ${found.name} for ${identity.key}`);
+		}
+		return {
+			projectId: found.projectId,
+			name: found.name,
+			environments: found.environments,
+			via: found.via
+		};
+	}
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(require_store.projectName(identity), withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
+}
+//#endregion
+//#region src/deploy/registry.ts
+/**
+* Which Dokploy registry a stage's images are pulled through.
+*
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
+*/
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.dokploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		this.stage = stage;
+		this.name = "RegistryNotConfigured";
+	}
+};
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
+	}
+};
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
+	}
+};
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof require_sniffer.DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
+	}
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
+//#region src/deploy/secrets.ts
+/**
+* Filter secrets to only include the env vars that an app requires.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Filtered secrets with found/missing tracking
+*/
+function filterSecretsForApp(stageSecrets, sniffedEnv) {
+	const allSecrets = require_storage.toEmbeddableSecrets(stageSecrets);
+	const filtered = {};
+	const found = [];
+	const missing = [];
+	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
+		filtered[key] = allSecrets[key];
+		found.push(key);
+	} else missing.push(key);
+	return {
+		appName: sniffedEnv.appName,
+		secrets: filtered,
+		found: found.sort(),
+		missing: missing.sort()
+	};
+}
+/**
+* Encrypt filtered secrets for an app.
+* Generates an ephemeral master key that should be injected into Dokploy.
+*
+* @param filteredSecrets - The filtered secrets for the app
+* @returns Encrypted payload with master key
+*/
+function encryptSecretsForApp(filteredSecrets) {
+	const payload = require_sniffer.encryptSecrets(filteredSecrets.secrets);
+	return {
+		appName: filteredSecrets.appName,
+		payload,
+		masterKey: payload.masterKey,
+		secretCount: Object.keys(filteredSecrets.secrets).length,
+		missingSecrets: filteredSecrets.missing
+	};
+}
+/**
+* Filter and encrypt secrets for an app in one step.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Encrypted secrets with master key
+*/
+function prepareSecretsForApp(stageSecrets, sniffedEnv) {
+	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+}
+/**
+* Prepare secrets for multiple apps.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedApps - Map of app name to sniffed environment
+* @returns Map of app name to encrypted secrets
+*/
+function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
+		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
+		results.set(appName, encrypted);
+	}
+	return results;
+}
+/**
+* Generate a report on secrets preparation.
+*/
+function generateSecretsReport(encryptedApps, sniffedApps) {
+	const appsWithSecrets = [];
+	const appsWithoutSecrets = [];
+	const appsWithMissingSecrets = [];
+	for (const [appName, sniffedEnv] of sniffedApps) {
+		if (sniffedEnv.requiredEnvVars.length === 0) {
+			appsWithoutSecrets.push(appName);
+			continue;
+		}
+		const encrypted = encryptedApps.get(appName);
+		if (encrypted) {
+			appsWithSecrets.push(appName);
+			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
+				appName,
+				missing: encrypted.missingSecrets
+			});
+		}
+	}
+	return {
+		totalApps: sniffedApps.size,
+		appsWithSecrets: appsWithSecrets.sort(),
+		appsWithoutSecrets: appsWithoutSecrets.sort(),
+		appsWithMissingSecrets
+	};
+}
+//#endregion
+//#region src/deploy/terminal.ts
+/**
+* The credentials `gkm deploy` can ask a person for. CLI layer only.
+*
+* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
+* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
+* this provider reads the environment and the stored login first, and only
+* when both are empty prompts — and stores a Dokploy login it validated, so
+* the next deploy does not ask again. With no terminal it answers nothing, and
+* the deploy says what was missing instead of waiting on a prompt nobody sees.
+*/
+const logger$1 = require_discover.output;
+/** What answers a deploy prompt without a terminal. */
+const INSTEAD = "Please configure manually.";
+/** The Dokploy URL typed at the prompt is not a URL. */
+var DokployEndpointInvalid = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid URL format");
+		this.endpoint = endpoint;
+		this.name = "DokployEndpointInvalid";
+	}
+};
+/** Dokploy refused the token typed at the prompt; nothing was stored. */
+var DokployTokenRejected = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid credentials. Please check your token.");
+		this.endpoint = endpoint;
+		this.name = "DokployTokenRejected";
+	}
+};
+/** Asks the person at the terminal for what nothing else supplied. */
+function asking() {
+	return { async get(asked) {
+		if (!require_sniffer.canPrompt()) return void 0;
+		const request = asked;
+		if (request.kind === "dokploy") {
+			logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
+			const endpoint = (await require_sniffer.prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
+			try {
+				new URL(endpoint);
+			} catch {
+				throw new DokployEndpointInvalid(endpoint);
+			}
+			logger$1.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			const token = await require_sniffer.prompt("API Token: ", {
+				hidden: true,
+				instead: INSTEAD
+			});
+			logger$1.log("\nValidating credentials...");
+			if (!await require_sniffer.validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
+			await require_sniffer.storeDokployCredentials(token, endpoint);
+			logger$1.log("✓ Credentials saved");
+			return {
+				endpoint,
+				token
+			};
+		}
+		logger$1.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
+		return {
+			username: await require_sniffer.prompt("Registry username: ", { instead: INSTEAD }),
+			password: await require_sniffer.prompt("Registry password/token: ", {
+				hidden: true,
+				instead: INSTEAD
+			})
+		};
+	} };
+}
+/**
+* The environment, then the stored login, then — at a terminal — the person
+* running the command.
+*/
+function terminalCredentials(base = storedCredentials()) {
+	return chainCredentials(base, asking());
+}
+//#endregion
+//#region src/deploy/index.ts
+/**
+* Deploy Module
+*
+* Handles deployment of GKM workspaces to various providers (Docker, Dokploy).
+*
+* ## Per-App Database Credentials
+*
+* When deploying to Dokploy with Postgres, this module creates per-app database
+* users with isolated schemas. This follows the same pattern as local dev mode
+* (docker/postgres/init.sh).
+*
+* ### How It Works
+*
+* 1. **Provisioning**: Creates Postgres service with master credentials
+* 2. **User Creation**: For each backend app that needs DATABASE_URL:
+*    - Generates a unique password (stored in deploy state)
+*    - Creates a database user with that password
+*    - Assigns schema permissions based on app name
+* 3. **Schema Assignment**:
+*    - `api` app: Uses `public` schema (shared tables)
+*    - Other apps (e.g., `auth`): Get their own schema with `search_path` set
+* 4. **Environment Injection**: Each app receives its own DATABASE_URL
+*
+* ### Security
+*
+* - External Postgres port is enabled only during user creation, then disabled
+* - Each app can only access its own schema
+* - Credentials are stored in `.gkm/deploy-{stage}.json` (gitignored)
+* - Subsequent deploys reuse existing credentials from state
+*
+* ### Example Flow
+*
+* ```
+* gkm deploy --stage production
+*   ├─ Create Postgres (user: postgres, db: myproject)
+*   ├─ Enable external port temporarily
+*   ├─ Create user "api" → public schema
+*   ├─ Create user "auth" → auth schema (search_path=auth)
+*   ├─ Disable external port
+*   ├─ Deploy "api" with DATABASE_URL=postgresql://api:xxx@postgres:5432/myproject
+*   └─ Deploy "auth" with DATABASE_URL=postgresql://auth:yyy@postgres:5432/myproject
+* ```
+*
+* @module deploy
+*/
+const logger = require_discover.output;
+/**
+* Wait for Postgres to be ready to accept connections.
+*
+* Polls the Postgres server until it accepts a connection or max retries reached.
+* Used after enabling the external port to ensure the database is accessible
+* before creating users.
+*
+* @param host - The Postgres server hostname
+* @param port - The external port (typically 5432)
+* @param user - Master database user (postgres)
+* @param password - Master database password
+* @param database - Database name to connect to
+* @param maxRetries - Maximum number of connection attempts (default: 30)
+* @param retryIntervalMs - Milliseconds between retries (default: 2000)
+* @throws Error if Postgres is not ready after maxRetries
+*/
+async function waitForPostgres(host, port, user, password, database, maxRetries = 30, retryIntervalMs = 2e3) {
+	for (let i = 0; i < maxRetries; i++) try {
+		const client = new pg.Client({
+			host,
+			port,
+			user,
+			password,
+			database,
+			connectionTimeoutMillis: 5e3
+		});
+		client.on("error", () => {});
+		await client.connect();
+		await client.end();
+		return;
+	} catch {
+		if (i < maxRetries - 1) {
+			logger.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			await new Promise((r) => setTimeout(r, retryIntervalMs));
+		}
+	}
+	throw new PostgresNotReady(host, port, maxRetries);
+}
+/** A Postgres published for the role DDL never accepted a connection. */
+var PostgresNotReady = class extends Error {
+	host;
+	port;
+	attempts;
+	constructor(host, port, attempts) {
+		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
+		this.host = host;
+		this.port = port;
+		this.attempts = attempts;
+		this.name = "PostgresNotReady";
+	}
+};
+/** No port could be published for a cluster, so its DDL cannot reach it. */
+var PostgresPortUnavailable = class extends Error {
+	appName;
+	taken;
+	constructor(appName, taken) {
+		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
+		this.appName = appName;
+		this.taken = taken;
+		this.name = "PostgresPortUnavailable";
+	}
+};
+/**
+* Run the manifest's DDL against a Dokploy Postgres.
+*
+* The cluster is only reachable from outside while an external port is
+* published, so this opens one, applies, and leaves it as it found it. The
+* alternative — running DDL from inside the network — needs a container to run
+* it in, which is what `DatabaseBootstrap` is on AWS and what a Dokploy target
+* has no equivalent for yet.
+*
+* The applier is the local target's, so every statement asks whether it is
+* needed first: a redeploy is free, and a half-applied run recovers by being
+* run again.
+*/
+/**
+* A high port for one service, the same one every time.
+*
+* Derived from the service name rather than random so two deploys of the same
+* database agree and two different databases do not collide — and in the
+* ephemeral range, above anything a server is likely to have bound
+* deliberately.
+*/
+function derivedPort(appName) {
+	const digest = (0, node_crypto.createHash)("sha256").update(appName).digest();
+	return 49152 + (digest[0] << 8 | digest[1]) % 16e3;
+}
+async function applyDeclaredStatements(api, postgres, serverHostname, statements) {
+	let externalPort = await api.getPostgres(postgres.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
+	const opened = externalPort === void 0;
+	if (externalPort === void 0) {
+		const taken = await api.publishedPorts().catch(() => /* @__PURE__ */ new Set());
+		const candidates = [5432, derivedPort(postgres.appName)].filter((port) => !taken.has(port));
+		for (const candidate of candidates) try {
+			await api.savePostgresExternalPort(postgres.postgresId, candidate);
+			externalPort = candidate;
+			break;
+		} catch (error) {
+			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
+			logger.log(`   Port ${candidate} is taken; trying another...`);
+		}
+		if (externalPort === void 0) throw new PostgresPortUnavailable(postgres.appName, [...taken]);
+		logger.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
+	}
+	await api.deployPostgres(postgres.postgresId);
+	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
+	const client = { async query(database, sql, values) {
+		const connection = new pg.Client({
+			host: serverHostname,
+			port: externalPort,
+			user: postgres.databaseUser,
+			password: postgres.databasePassword,
+			database: database ?? postgres.databaseName,
+			connectionTimeoutMillis: 15e3
+		});
+		connection.on("error", () => {});
+		await connection.connect();
+		try {
+			return (await connection.query(sql, values)).rows;
+		} finally {
+			await connection.end();
+		}
+	} };
+	const unpublish = async () => {
+		if (!opened) return;
+		await api.savePostgresExternalPort(postgres.postgresId, null).then(() => api.deployPostgres(postgres.postgresId)).catch(() => {
+			logger.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
+		});
+	};
+	let lastError;
+	try {
+		for (let attempt = 1; attempt <= 3; attempt++) try {
+			return await applyDeclared(client, statements);
+		} catch (error) {
+			lastError = error;
+			if (attempt === 3) break;
+			const message = error instanceof Error ? error.message : String(error);
+			logger.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+			await new Promise((resolve) => setTimeout(resolve, 1e4));
+			await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName).catch(() => {});
+		}
+		throw lastError;
+	} finally {
+		await unpublish();
+	}
+}
+/**
+* Get the server hostname from the Dokploy endpoint URL
+*/
+function getServerHostname(endpoint) {
+	return new URL(endpoint).hostname;
+}
+/**
+* Generate image tag from stage and timestamp
+*/
+function generateTag(stage) {
+	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
+}
+/**
+* The things this deploy creates a container for.
+*
+* A deploy unit is a *declaration*, not a config entry — and since that is now
+* true of every app, not just the ones being deployed, this is the workspace's
+* own derivation under the name the deploy phases call it by.
+*/
+function deployUnits(manifest, workspace) {
+	return require_config.derivedApps(manifest, workspace);
+}
+/**
+* The variables an app cannot start without.
+*
+* The sniffer reports every key it saw in `requiredEnvVars` and says which of
+* them were read through `.optional()` or `.default()` in `optionalEnvVars`.
+* Reading only the first treats a key that is *absent by design* as a missing
+* secret — `AUTH_COOKIE_DOMAIN` is published only when a surface has a domain
+* to widen a cookie to, and one host has nothing to share it with.
+*
+* The same distinction `bundleServer` draws. It is drawn twice because the
+* bundle and the deploy each validate, and the deploy was the half still
+* failing on an answer that was correct.
+*/
+function requiredOf(requirements) {
+	if (!requirements) return [];
+	const optional = new Set(requirements.optionalEnvVars);
+	return requirements.requiredEnvVars.map((name) => name.endsWith("?") ? name.slice(0, -1) : name).filter((name) => !optional.has(name));
+}
+/** Apps were asked for by name that the workspace does not have. */
+var UnknownDeployApps = class extends Error {
+	apps;
+	available;
+	constructor(apps, available) {
+		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
+		this.apps = apps;
+		this.available = available;
+		this.name = "UnknownDeployApps";
+	}
+};
+/** Every app asked for deploys somewhere other than Dokploy. */
+var NoDeployableApps = class extends Error {
+	stage;
+	constructor(stage) {
+		super("No apps to deploy. All selected apps have unsupported deploy targets.");
+		this.stage = stage;
+		this.name = "NoDeployableApps";
+	}
+};
+/** A backend failed, so the run stopped before deploying anything after it. */
+var BackendDeployFailed = class extends Error {
+	app;
+	constructor(app, cause) {
+		super(`Backend deployment failed for ${app}. Aborting to prevent partial deployment.`, { cause });
+		this.app = app;
+		this.name = "BackendDeployFailed";
+	}
+};
+/** An app's environment needs values the stage does not have. */
+var MissingEnvVars = class extends Error {
+	app;
+	missing;
+	stage;
+	constructor(app, missing, stage) {
+		super(formatMissingVarsError(app, [...missing], stage));
+		this.app = app;
+		this.missing = missing;
+		this.stage = stage;
+		this.name = "MissingEnvVars";
+	}
+};
+/** Workspace deploys go to Dokploy; another provider was asked for. */
+var DeployProviderUnsupported = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`Workspace deployment only supports Dokploy. Got: ${provider}`);
+		this.provider = provider;
+		this.name = "DeployProviderUnsupported";
+	}
+};
+/** How `resolveProject` found a project, in the journal's words. */
+const PROJECT_VIA = {
+	state: "recorded",
+	marker: "found",
+	created: "created"
+};
+/**
+* Deploy every app in a workspace to Dokploy.
+*
+* Two-phase orchestration:
+* - PHASE 1: Deploy backend apps (with encrypted secrets)
+* - PHASE 2: Deploy frontend apps (with public URLs from backends)
+*
+* Security model:
+* - Backend apps get encrypted secrets embedded at build time
+* - Only GKM_MASTER_KEY is injected as Dokploy env var
+* - Frontend apps get public URLs baked in at build time (no secrets)
+*
+* The engine under `deploy()` and `gkm deploy`. It never prompts and never
+* exits: credentials come from `ctx.credentials`, progress goes to
+* `ctx.emit` and to `output`, and every failure is thrown.
+*
+* @internal
+*/
+async function runDeploy(source, request, ctx) {
+	const { stage, tag, apps: selectedApps } = request;
+	ctx.emit({
+		type: "phase.started",
+		phase: "validate"
+	});
+	const configured = typeof source === "function" ? await source() : source;
+	const manifest = await require_discover.discover({
+		patterns: require_sniffer.constructGlobs(configured),
+		cwd: configured.root
+	});
+	const units = deployUnits(manifest, configured);
+	const workspace = Object.keys(units).length > 0 ? {
+		...configured,
+		apps: units
+	} : configured;
+	const identity = require_store.deployIdentity(workspace, stage);
+	logger.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
+	logger.log(`   Stage: ${stage}`);
+	const imageTag = tag ?? generateTag(stage);
+	logger.log(`   Tag: ${imageTag}`);
+	const buildOrder = require_workspace.getAppBuildOrder(workspace);
+	let appsToDeployNames = buildOrder;
+	if (selectedApps && selectedApps.length > 0) {
+		const invalidApps = selectedApps.filter((name) => !workspace.apps[name]);
+		if (invalidApps.length > 0) throw new UnknownDeployApps(invalidApps, Object.keys(workspace.apps));
+		appsToDeployNames = buildOrder.filter((name) => selectedApps.includes(name));
+		logger.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
+	} else logger.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
+	const skipped = [];
+	const skip = (app, reason) => {
+		skipped.push({
+			app,
+			reason
+		});
+		ctx.emit({
+			type: "app.skipped",
+			app,
+			reason
+		});
+	};
+	const dokployApps = appsToDeployNames.filter((name) => {
+		const target = workspace.apps[name].resolvedDeployTarget;
+		if (target === "sst") {
+			const reason = `it deploys with SST — run \`gkm build && sst deploy --stage ${stage}\``;
+			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
+			skip(name, reason);
+			return false;
+		}
+		if (!require_workspace.isDeployTargetSupported(target)) {
+			const reason = require_workspace.getDeployTargetError(target, name);
+			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
+			skip(name, reason);
+			return false;
+		}
+		return true;
+	});
+	if (dokployApps.length === 0) throw new NoDeployableApps(stage);
+	appsToDeployNames = dokployApps;
+	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") skip(name, MOBILE_SKIP_REASON);
+	ctx.emit({
+		type: "deploy.started",
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		apps: appsToDeployNames.filter((name) => workspace.apps[name].type !== "mobile"),
+		dryRun: ctx.dryRun
+	});
+	const store = await require_sniffer.createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
+	const run = {
+		workspace,
+		manifest,
+		stage,
+		imageTag,
+		appsToDeployNames,
+		identity,
+		store,
+		skipped,
+		ctx
+	};
+	if (ctx.dryRun) return planDeploy(run);
+	const lock = await store.lock(stage, { operation: "deploy" });
+	try {
+		return await deployLocked(run);
+	} finally {
+		await lock.release();
+	}
+}
+/**
+* The stage's secrets and every app's environment requirements. A dry run
+* reads the secrets and generates nothing into the store.
+*/
+async function preflight({ workspace, manifest, stage, ctx }) {
+	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
+	const secretsStore = await require_store.secretsStoreFor(workspace, stage, { ...ctx.home ? { home: ctx.home } : {} });
+	const stored = await secretsStore.read(stage);
+	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
+	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
+	if (generated.length > 0) {
+		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		else {
+			await secretsStore.write(stage, stageSecrets);
+			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		}
+	}
+	const sniffedApps = await require_sniffer.sniffAllApps(workspace.apps, workspace.root);
+	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
+	if (stageSecrets) {
+		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
+		if (report.appsWithSecrets.length > 0) logger.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
+		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
+	}
+	return {
+		stageSecrets,
+		sniffedApps,
+		encryptedSecrets
+	};
+}
+/** Everything a deploy does while it holds the stage's lock. */
+async function deployLocked(run) {
+	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity, store, ctx } = run;
+	const { stageSecrets, sniffedApps, encryptedSecrets } = await preflight(run);
+	ctx.emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	const changes = [];
+	const applied = (change, via) => {
+		changes.push(change);
+		ctx.emit({
+			type: "resource.applied",
+			...change,
+			via
+		});
+	};
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "provision"
+	});
+	const { api, endpoint } = await dokployApi(workspace, ctx);
+	logger.log("\n📋 Loading deploy state...");
+	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
+	const state = journal.state;
+	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
+	else logger.log(`   Creating new state for stage "${stage}"`);
+	const unfinished = journal.unfinished();
+	if (unfinished.length > 0) logger.log(`   ⚠ A previous run stopped while creating: ${unfinished.join(", ")} — looking for them before creating anything`);
+	logger.log("\n📁 Setting up Dokploy project...");
+	logger.log(`   Identity: ${identity.key}`);
+	const projectEntry = {
+		key: "project",
+		type: "project",
+		data: {
+			name: require_store.projectName(identity),
+			identity: identity.key
+		}
+	};
+	const project = await resolveProject(api, identity, state.projectId || void 0, (message) => logger.log(message), { beforeCreate: () => journal.pending(projectEntry) });
+	await journal.ready(projectEntry, project.projectId);
+	applied({
+		key: "project",
+		resourceType: "project",
+		action: project.via === "created" ? "create" : "reuse",
+		id: project.projectId
+	}, PROJECT_VIA[project.via]);
+	if (project.via === "created") logger.log(`   ✓ Created project: ${project.projectId}`);
+	else logger.log(`   Found existing project: ${project.name}`);
+	const environmentEntry = {
+		key: "environment",
+		type: "environment",
+		data: { name: stage }
+	};
+	const environment = await journal.ensure(environmentEntry, {
+		find: async () => project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase()),
+		create: () => {
+			logger.log(`   Creating "${stage}" environment...`);
+			return api.createEnvironment(project.projectId, stage);
+		},
+		id: (e) => e.environmentId
+	});
+	const environmentId = environment.resource.environmentId;
+	applied({
+		key: "environment",
+		resourceType: "environment",
+		action: environment.via === "created" ? "create" : "reuse",
+		id: environmentId
+	}, environment.via);
+	if (environment.via === "created") logger.log(`   ✓ Created environment: ${stage}`);
+	else logger.log(`   Using environment: ${environment.resource.name}`);
+	if (journal.existed) {
+		if (state.projectId && state.projectId !== project.projectId) logger.log(`   ⚠ Project ID changed, updating state`);
+		if (state.environmentId && state.environmentId !== environmentId) logger.log(`   ⚠ Environment ID changed, updating state`);
+	}
+	state.projectId = project.projectId;
+	state.environmentId = environmentId;
+	state.identity = identity.key;
+	logger.log("\n🐳 Checking registry...");
+	const registry = workspace.deploy.dokploy?.registry;
+	let registryCreated = false;
+	const dokployRegistry = await resolveRegistry(api, {
+		stage,
+		registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state.registryId,
+		log: (message) => logger.log(message),
+		create: async (url) => {
+			const login = await ctx.credentials.get({
+				kind: "registry",
+				url
+			}, { signal: ctx.signal });
+			if (!login) throw new MissingCredential("registry", url);
+			const created = await api.createRegistry("Default Registry", url, login.username, login.password);
+			registryCreated = true;
+			logger.log(`   ✓ Registry created: ${created.registryId}`);
+			return created;
+		}
+	});
+	const registryId = dokployRegistry.registryId;
+	state.registryId = registryId;
+	applied({
+		key: "registry",
+		resourceType: "registry",
+		action: registryCreated ? "create" : "reuse",
+		id: registryId
+	}, registryCreated ? "created" : "found");
+	logger.log(`   Using registry: ${dokployRegistry.registryName}`);
+	await journal.save();
+	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
+	if (skippedMobileApps.length > 0) logger.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
+	let declaredEnv = {};
+	let declaredClusters = {};
+	{
+		logger.log("\n📦 Provisioning declared constructs...");
+		const appUrls = {};
+		for (const appName of appsToDeployNames) {
+			if (workspace.apps[appName]?.type !== "backend") continue;
+			appUrls[appName] = `https://${hostOf(workspace, appName, stage)}`;
+		}
+		const declared = await provisionDeclared({
+			api,
+			workspace,
+			projectId: project.projectId,
+			environmentId,
+			stage,
+			scope: identity.scope,
+			appUrls,
+			supplied: stageSecrets.custom,
+			seed: stageSecrets.seed,
+			manifest
+		});
+		declaredEnv = declared.env;
+		declaredClusters = declared.clusters;
+		if (Object.keys(declaredEnv).length > 0) logger.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
+		if (declared.statements.length > 0) {
+			const serverHostname = getServerHostname(endpoint);
+			for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
+				const statements = declared.statements.filter((statement) => statement.database === databaseName);
+				if (statements.length === 0) continue;
+				const created = await applyDeclaredStatements(api, cluster, serverHostname, statements);
+				logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+			}
+		}
+	}
+	const backupCluster = Object.values(declaredClusters)[0];
+	if (workspace.deploy?.backups && backupCluster) {
+		logger.log("\n💾 Provisioning backup destination...");
+		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-BmhIO_Yr.cjs"));
+		const backupState = await provisionBackupDestination({
+			api,
+			projectId: project.projectId,
+			projectName: identity.scope,
+			stage,
+			config: workspace.deploy.backups,
+			existingState: getBackupState(state),
+			logger
+		});
+		setBackupState(state, backupState);
+		if (!backupState.postgresBackupId) {
+			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
+			const backupRetention = workspace.deploy.backups.retention ?? 30;
+			logger.log("   Creating postgres backup schedule...");
+			setPostgresBackupId(state, (await api.createPostgresBackup({
+				schedule: backupSchedule,
+				prefix: `${stage}/postgres`,
+				destinationId: backupState.destinationId,
+				database: backupCluster.databaseName,
+				postgresId: backupCluster.postgresId,
+				enabled: true,
+				keepLatestCount: backupRetention
+			})).backupId);
+			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger.log("   ✓ Using existing postgres backup schedule");
+	}
+	ctx.emit({
+		type: "phase.finished",
+		phase: "provision"
+	});
+	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
+	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
+	const publicUrls = {};
+	const results = [];
+	const appHostnames = /* @__PURE__ */ new Map();
+	const appDomainIds = /* @__PURE__ */ new Map();
+	/** An app is up: say so, and remember where. */
+	const deployed = (appName, result, host) => {
+		const url = `https://${host}`;
+		results.push({
+			...result,
+			success: true,
+			url
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: appName,
+			applicationId: result.applicationId,
+			imageRef: result.imageRef,
+			url
+		});
+	};
+	/** An app failed: say so, and record it in the result. */
+	const failed = (appName, app, error) => {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+		results.push({
+			appName,
+			type: app.type,
+			success: false,
+			error: message
+		});
+		ctx.emit({
+			type: "app.failed",
+			app: appName,
+			error: eventError(error)
+		});
+	};
+	/** An image is pushed: worth keeping even if what follows fails. */
+	const built = async (appName, image, ref) => {
+		setDeployedImage(state, appName, {
+			ref: image.imageRef ?? ref,
+			...image.digest ? { digest: image.digest } : {}
+		});
+		await journal.save();
+		ctx.emit({
+			type: "artifact.built",
+			app: appName,
+			imageRef: image.imageRef ?? ref,
+			...image.digest ? { digest: image.digest } : {}
+		});
+		changes.push({
+			key: `image:${appName}`,
+			resourceType: "image",
+			action: "build",
+			id: image.digest ?? image.imageRef ?? ref
+		});
+	};
+	const frontendUrls = [];
+	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "release"
+	});
+	if (backendApps.length > 0) {
+		logger.log("\n📦 PHASE 1: Deploying backend applications...");
+		for (const appName of backendApps) {
+			ctx.signal?.throwIfAborted();
+			const app = workspace.apps[appName];
+			logger.log(`\n   ⚙️  Deploying ${appName}...`);
+			try {
+				const application = await ensureApplication(api, journal, appName, require_store.applicationName(identity, appName), project.projectId, environmentId, applied);
+				const appSecrets = encryptedSecrets.get(appName);
+				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
+					encrypted: appSecrets.payload.encrypted,
+					iv: appSecrets.payload.iv
+				} : void 0;
+				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
+				const imageRef$1 = require_store.imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$1}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: require_store.imageName(identity, appName),
+						appName
+					},
+					credentials,
+					...dockerRun(workspace, app, ctx)
+				});
+				await built(appName, image, imageRef$1);
+				const backendHost = hostOf(workspace, appName, stage);
+				const dependencyUrls = {};
+				if (app.dependencies) {
+					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
+				}
+				const envContext = {
+					app,
+					appName,
+					stage,
+					state,
+					appHostname: backendHost,
+					frontendUrls,
+					userSecrets: stageSecrets ?? void 0,
+					masterKey: appSecrets?.masterKey,
+					dependencyUrls
+				};
+				const sniffedVars = requiredOf(sniffedApps.get(appName));
+				const { valid, missing, resolved } = validateEnvVars([.../* @__PURE__ */ new Set([
+					"PORT",
+					"NODE_ENV",
+					"STAGE",
+					...sniffedVars
+				])], envContext);
+				if (!valid) throw new MissingEnvVars(appName, missing, stage);
+				const withDeclared = {
+					...resolved,
+					...declaredEnv
+				};
+				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
+				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
+				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
+				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
+				logger.log(`      Deploying to Dokploy...`);
+				await api.deployApplication(application.applicationId);
+				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId, applied);
+				appHostnames.set(appName, backendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${backendHost}`;
+				deployed(appName, {
+					appName,
+					type: app.type,
+					applicationId: application.applicationId,
+					imageRef: imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, backendHost);
+				logger.log(`      ✓ ${appName} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(appName, app, error);
+				throw new BackendDeployFailed(appName, error);
+			}
+		}
+	}
+	if (frontendApps.length > 0) {
+		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
+		for (const appName of frontendApps) {
+			ctx.signal?.throwIfAborted();
+			const app = workspace.apps[appName];
+			logger.log(`\n   🌐 Deploying ${appName}...`);
+			try {
+				const application = await ensureApplication(api, journal, appName, require_store.applicationName(identity, appName), project.projectId, environmentId, applied);
+				const dependencyUrls = {};
+				if (app.dependencies) {
+					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
+				}
+				const frontendHost = hostOf(workspace, appName, stage);
+				const envContext = {
+					app,
+					appName,
+					stage,
+					state,
+					appHostname: frontendHost,
+					frontendUrls: [],
+					userSecrets: stageSecrets ?? void 0,
+					dependencyUrls
+				};
+				const { valid, missing, resolved } = validateEnvVars(requiredOf(sniffedApps.get(appName)), envContext);
+				if (!valid) throw new MissingEnvVars(appName, missing, stage);
+				if (Object.keys(resolved).length > 0) logger.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
+				const buildArgs = [];
+				const publicUrlArgNames = [];
+				if (publicPrefix) {
+					for (const [key, value] of Object.entries(resolved)) if (key.startsWith(publicPrefix)) {
+						buildArgs.push(`${key}=${value}`);
+						publicUrlArgNames.push(key);
+					}
+				}
+				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
+				const imageRef$2 = require_store.imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$2}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: require_store.imageName(identity, appName),
+						appName
+					},
+					buildArgs,
+					publicUrlArgs: publicUrlArgNames,
+					...dockerRun(workspace, app, ctx)
+				});
+				await built(appName, image, imageRef$2);
+				const envVars = [
+					`NODE_ENV=production`,
+					`PORT=${app.port}`,
+					`STAGE=${stage}`
+				];
+				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
+				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
+				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
+				logger.log(`      Deploying to Dokploy...`);
+				await api.deployApplication(application.applicationId);
+				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId, applied);
+				appHostnames.set(appName, frontendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${frontendHost}`;
+				deployed(appName, {
+					appName,
+					type: app.type,
+					applicationId: application.applicationId,
+					imageRef: imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, frontendHost);
+				logger.log(`      ✓ ${appName} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(appName, app, error);
+			}
+		}
+	}
+	logger.log("\n📋 Saving deploy state...");
+	await journal.save();
+	logger.log("   ✓ State saved");
+	ctx.emit({
+		type: "phase.finished",
+		phase: "release"
+	});
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "verify"
+	});
+	const dnsConfig = workspace.deploy.dns;
+	if (dnsConfig && appHostnames.size > 0) {
+		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
+		if (dnsResult?.serverIp && appHostnames.size > 0) {
+			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
+			await journal.save();
+		}
+		if (dnsResult?.success && appHostnames.size > 0) {
+			logger.log("\n🔒 Validating domains for SSL certificates...");
+			for (const [appName, hostname] of appHostnames) try {
+				const result = await api.validateDomain(hostname);
+				if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+				else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
+			} catch (validationError) {
+				const message = validationError instanceof Error ? validationError.message : "Unknown error";
+				logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
+			}
+		}
+	}
+	ctx.emit({
+		type: "phase.finished",
+		phase: "verify"
+	});
+	const successCount = results.filter((r) => r.success).length;
+	const failedCount = results.filter((r) => !r.success).length;
+	logger.log(`\n${"─".repeat(50)}`);
+	logger.log(`\n✅ Workspace deployment complete!`);
+	logger.log(`   Project: ${project.projectId}`);
+	logger.log(`   Successful: ${successCount}`);
+	if (failedCount > 0) logger.log(`   Failed: ${failedCount}`);
+	if (Object.keys(publicUrls).length > 0) {
+		logger.log("\n   📡 Deployed URLs:");
+		for (const [name, url] of Object.entries(publicUrls)) logger.log(`      ${name}: ${url}`);
+	}
+	return {
+		apps: results,
+		projectId: project.projectId,
+		environmentId,
+		successCount,
+		failedCount,
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		dryRun: false,
+		skipped: run.skipped,
+		urls: publicUrls,
+		changes
+	};
+}
+/**
+* An app's Dokploy application, through the journal: by the id recorded for
+* it, else by its name in the stage's environment, else created. Its id goes
+* into `state.applications` too, which the env resolver and `state:show` read.
+*/
+async function ensureApplication(api, journal, appName, dokployAppName, projectId, environmentId, applied) {
+	const recorded = journal.record(`application:${appName}`);
+	if (recorded?.status === "ready" && recorded.id) logger.log(`      Using cached ID: ${recorded.id}`);
+	const { resource, via, staleId } = await journal.ensure({
+		key: `application:${appName}`,
+		type: "application",
+		data: { name: dokployAppName }
+	}, {
+		get: (id) => api.getApplication(id),
+		find: () => api.findApplicationByName(projectId, dokployAppName, environmentId),
+		create: () => api.createApplication(dokployAppName, projectId, environmentId),
+		id: (application) => application.applicationId
+	});
+	if (staleId) logger.log(`      ⚠ Cached ID invalid, will create new`);
+	logger.log(`      ${{
+		recorded: "✓ Application found",
+		resumed: "Resumed application a stopped run created",
+		found: "Found existing application",
+		created: "Created application"
+	}[via]}: ${resource.applicationId}`);
+	applied({
+		key: `application:${appName}`,
+		resourceType: "application",
+		action: via === "created" ? "create" : "reuse",
+		id: resource.applicationId
+	}, via);
+	setApplicationId(journal.state, appName, resource.applicationId);
+	return resource;
+}
+/**
+* The domain `host` routes to an application, through the journal — found on
+* the application before it is created, so a re-run never adds a second.
+*
+* A domain that cannot be created is reported and skipped rather than
+* failing the app: the application is deployed and reachable on Dokploy's
+* own address, and DNS is fixed by hand more easily than a half deploy.
+*/
+async function ensureDomain(api, journal, host, port, applicationId, applied) {
+	try {
+		const { resource, via } = await journal.ensure({
+			key: `domain:${host}`,
+			type: "domain",
+			data: {
+				host,
+				applicationId
+			}
+		}, {
+			find: async () => (await api.getDomainsByApplicationId(applicationId)).find((d) => d.host === host),
+			create: () => api.createDomain({
+				host,
+				port,
+				https: true,
+				certificateType: "letsencrypt",
+				applicationId
+			}),
+			id: (domain) => domain.domainId
+		});
+		logger.log(`      ✓ Domain: https://${host} (${via === "created" ? "created" : "existing"})`);
+		applied({
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: via === "created" ? "create" : "reuse",
+			id: resource.domainId
+		}, via);
+		return resource.domainId;
+	} catch (domainError) {
+		if (domainError instanceof require_sniffer.StateVersionConflict || domainError instanceof require_sniffer.StateStoreBusy || isAbort(domainError)) throw domainError;
+		const message = domainError instanceof Error ? domainError.message : "Unknown error";
+		logger.log(`      ⚠ Domain creation failed: ${message}`);
+		return;
+	}
+}
+/** Whether `error` is a run being stopped rather than something failing. */
+function isAbort(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+/** Where docker runs for one app: in the app's own directory. */
+function dockerRun(workspace, app, ctx) {
+	return {
+		cwd: (0, node_path.resolve)(workspace.root, app.path),
+		...ctx.signal ? { signal: ctx.signal } : {},
+		...ctx.stdio ? { stdio: ctx.stdio } : {}
+	};
+}
+/** The Dokploy login, from the run's provider, or `MissingCredential`. */
+async function dokployApi(workspace, ctx) {
+	const configured = workspace.deploy.dokploy?.endpoint;
+	const creds = await ctx.credentials.get({
+		kind: "dokploy",
+		...configured ? { endpoint: configured } : {}
+	}, { signal: ctx.signal });
+	if (!creds) throw new MissingCredential("dokploy", configured);
+	return {
+		api: new require_sniffer.DokployApi({
+			baseUrl: creds.endpoint,
+			token: creds.token,
+			...ctx.signal ? { signal: ctx.signal } : {}
+		}),
+		endpoint: creds.endpoint
+	};
+}
+/** Each app's public host, the same way the deploy resolves it. */
+function hostOf(workspace, appName, stage) {
+	const app = workspace.apps[appName];
+	return require_sniffer.resolveHost(appName, app, stage, workspace.deploy?.domains, app.type === "web" && require_sniffer.isMainFrontendApp(appName, app, workspace.apps));
+}
+/**
+* What a deploy would do, from the same lookups it starts with — and nothing
+* else: no lock, no state written, no secret generated, no Dokploy resource
+* created or changed, no image built or pushed.
+*/
+async function planDeploy(run) {
+	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity } = run;
+	const { ctx } = run;
+	await preflight(run);
+	ctx.emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "plan"
+	});
+	logger.log("\n🔎 Dry run: nothing will be created, changed, built or pushed.");
+	const changes = [];
+	const plan = (change, detail) => {
+		changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+		const sign = change.action === "reuse" ? "=" : "+";
+		logger.log(`   ${sign} ${change.action} ${change.key} (${detail})`);
+	};
+	const { api } = await dokployApi(workspace, ctx);
+	const state = (await run.store.read(stage))?.state;
+	const project = await findProject(api, identity, state?.projectId);
+	if (project) plan({
+		key: "project",
+		resourceType: "project",
+		action: "reuse",
+		id: project.projectId
+	}, project.needsClaim ? `${project.name}, would be claimed for ${identity.key}` : project.name);
+	else plan({
+		key: "project",
+		resourceType: "project",
+		action: "create"
+	}, require_store.projectName(identity));
+	const environment = project?.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
+	plan(environment ? {
+		key: "environment",
+		resourceType: "environment",
+		action: "reuse",
+		id: environment.environmentId
+	} : {
+		key: "environment",
+		resourceType: "environment",
+		action: "create"
+	}, stage);
+	let registryPlanned;
+	const registry = await resolveRegistry(api, {
+		stage,
+		registry: workspace.deploy.dokploy?.registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state?.registryId,
+		log: (message) => logger.log(message),
+		create: async (url) => {
+			registryPlanned = {
+				key: "registry",
+				resourceType: "registry",
+				action: "create"
+			};
+			return {
+				registryId: "",
+				registryName: url
+			};
+		}
+	});
+	plan(registryPlanned ?? {
+		key: "registry",
+		resourceType: "registry",
+		action: "reuse",
+		id: registry.registryId
+	}, registry.registryName);
+	for (const [id, declaration] of Object.entries(manifest)) plan({
+		key: `construct:${id}`,
+		resourceType: declaration.kind,
+		action: "ensure"
+	}, declaration.kind);
+	const apps = [];
+	const urls = {};
+	for (const appName of appsToDeployNames) {
+		const app = workspace.apps[appName];
+		if (app.type === "mobile") continue;
+		const dokployAppName = require_store.applicationName(identity, appName);
+		const recordedId = state?.applications?.[appName];
+		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
+		plan(existing ? {
+			key: `application:${appName}`,
+			resourceType: "application",
+			action: "reuse",
+			id: existing.applicationId
+		} : {
+			key: `application:${appName}`,
+			resourceType: "application",
+			action: "create"
+		}, dokployAppName);
+		const ref = require_store.imageRef(identity, appName, workspace.deploy.dokploy?.registry, imageTag);
+		plan({
+			key: `image:${appName}`,
+			resourceType: "image",
+			action: "build"
+		}, ref);
+		const host = hostOf(workspace, appName, stage);
+		const domain = existing ? (await api.getDomainsByApplicationId(existing.applicationId)).find((d) => d.host === host) : void 0;
+		plan(domain ? {
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: "reuse",
+			id: domain.domainId
+		} : {
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: "create"
+		}, `https://${host}`);
+		urls[appName] = `https://${host}`;
+		apps.push({
+			appName,
+			type: app.type,
+			success: true,
+			imageRef: ref,
+			url: urls[appName],
+			...existing ? { applicationId: existing.applicationId } : {}
+		});
+	}
+	const creates = changes.filter((c) => c.action !== "reuse").length;
+	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
+	ctx.emit({
+		type: "phase.finished",
+		phase: "plan"
+	});
+	return {
+		apps,
+		projectId: project?.projectId ?? "",
+		environmentId: environment?.environmentId ?? "",
+		successCount: apps.length,
+		failedCount: 0,
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		dryRun: true,
+		skipped: run.skipped,
+		urls,
+		changes
+	};
+}
+/** Why a mobile app is left out of a Dokploy deploy. */
+const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
+//#endregion
+//#region src/deploy/deploy.ts
+/**
+* `deploy()`: a deploy as a library call.
+*
+* `gkm deploy` could only be driven from an interactive terminal: it prompted
+* for what it lacked and exited the process on failure, worked out of
+* `process.cwd()`, and reported progress by printing. Here the caller says
+* where the project is, hands over the credentials and a signal, and gets back
+* a run — events to iterate while it goes, and a structured result at the end.
+* Nothing below this asks a person anything or ends the process; `gkm deploy`
+* is a thin wrapper that does both.
+*/
+/**
+* Every event a run emits, kept so that each iteration — however late it
+* starts — sees the run from its first event to its last.
+*/
+var EventLog = class {
+	events = [];
+	closed = false;
+	waiting = [];
+	push(event) {
+		this.events.push(event);
+		this.wake();
+	}
+	close() {
+		this.closed = true;
+		this.wake();
+	}
+	wake() {
+		const waiting = this.waiting;
+		this.waiting = [];
+		for (const resume of waiting) resume();
+	}
+	async *iterate() {
+		let next = 0;
+		while (true) if (next < this.events.length) yield this.events[next++];
+		else if (this.closed) return;
+		else await new Promise((resume) => this.waiting.push(resume));
+	}
+};
+/** `childOutput` as `spawn` reads it, where it is not the default. */
+const CHILD_STDIO = {
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+function forward(logger, level, message) {
+	if (!logger) return;
+	if (level === "info") logger.info(message);
+	else if (level === "error" && logger.error) logger.error(message);
+	else logger.warn(message);
+}
+/**
+* Deploy a project's stage.
+*
+* ```ts
+* import { deploy } from '@geekmidas/cli/deploy';
+*
+* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
+* for await (const event of run) {
+*   if (event.type === 'app.deployed') console.log(event.app, event.url);
+* }
+* const result = await run.result;
+* ```
+*
+* The run starts at once; iterating it is optional, and an iteration started
+* late still sees every event from the first.
+*/
+function deploy(input) {
+	const log = new EventLog();
+	const emit = (event) => {
+		log.push(event);
+		if (event.type === "log") forward(input.logger, event.level, event.message);
+	};
+	const ctx = {
+		emit,
+		credentials: input.credentials ?? storedCredentials({ home: input.home ?? require_home.gkmHome() }),
+		dryRun: input.dryRun ?? false,
+		home: input.home ?? require_home.gkmHome(),
+		...input.signal ? { signal: input.signal } : {},
+		...input.childOutput && input.childOutput !== "inherit" ? { stdio: CHILD_STDIO[input.childOutput] } : {}
+	};
+	const result = require_discover.withOutput((level, message) => emit({
+		type: "log",
+		level,
+		message
+	}), async () => {
+		try {
+			input.signal?.throwIfAborted();
+			const deployed = await runDeploy(() => load(input), {
+				stage: input.stage,
+				...input.tag ? { tag: input.tag } : {},
+				...input.apps ? { apps: input.apps } : {}
+			}, ctx);
+			emit({
+				type: "deploy.finished",
+				result: deployed
+			});
+			return deployed;
+		} catch (error) {
+			emit({
+				type: "deploy.failed",
+				error: eventError(error)
+			});
+			throw error;
+		} finally {
+			log.close();
+		}
+	});
+	result.catch(() => {});
+	return {
+		result,
+		[Symbol.asyncIterator]: () => log.iterate()
+	};
+}
+/** The workspace at `input.cwd`, refusing a stage it does not deploy. */
+async function load(input) {
+	const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd));
+	require_workspace.assertDeployedStage(workspace.stages, input.stage);
+	return workspace;
+}
+//#endregion
+Object.defineProperty(exports, "BackendDeployFailed", {
+	enumerable: true,
+	get: function() {
+		return BackendDeployFailed;
+	}
+});
+Object.defineProperty(exports, "DeployProviderUnsupported", {
+	enumerable: true,
+	get: function() {
+		return DeployProviderUnsupported;
+	}
+});
+Object.defineProperty(exports, "MissingCredential", {
+	enumerable: true,
+	get: function() {
+		return MissingCredential;
+	}
+});
+Object.defineProperty(exports, "MissingEnvVars", {
+	enumerable: true,
+	get: function() {
+		return MissingEnvVars;
+	}
+});
+Object.defineProperty(exports, "NoDeployableApps", {
+	enumerable: true,
+	get: function() {
+		return NoDeployableApps;
+	}
+});
+Object.defineProperty(exports, "ProjectNotOwned", {
+	enumerable: true,
+	get: function() {
+		return ProjectNotOwned;
+	}
+});
+Object.defineProperty(exports, "RegistryAmbiguous", {
+	enumerable: true,
+	get: function() {
+		return RegistryAmbiguous;
+	}
+});
+Object.defineProperty(exports, "RegistryNotConfigured", {
+	enumerable: true,
+	get: function() {
+		return RegistryNotConfigured;
+	}
+});
+Object.defineProperty(exports, "RegistryNotFound", {
+	enumerable: true,
+	get: function() {
+		return RegistryNotFound;
+	}
+});
+Object.defineProperty(exports, "UnknownDeployApps", {
+	enumerable: true,
+	get: function() {
+		return UnknownDeployApps;
+	}
+});
+Object.defineProperty(exports, "chainCredentials", {
+	enumerable: true,
+	get: function() {
+		return chainCredentials;
+	}
+});
+Object.defineProperty(exports, "deploy", {
+	enumerable: true,
+	get: function() {
+		return deploy;
+	}
+});
+Object.defineProperty(exports, "storedCredentials", {
+	enumerable: true,
+	get: function() {
+		return storedCredentials;
+	}
+});
+Object.defineProperty(exports, "terminalCredentials", {
+	enumerable: true,
+	get: function() {
+		return terminalCredentials;
+	}
+});
+
+//# sourceMappingURL=deploy-0fBVeWO-.cjs.map