@geekmidas/cli 10.0.0-alpha.6 → 10.0.0-alpha.60

package/dist/deploy-D6Q09OkA.mjs

@@ -0,0 +1,3429 @@
+import { B as providerOf, C as run, D as constructGlobs, L as resourceName, N as applyPostgres, R as cacheBackendFor, S as keyFingerprint, V as storageBackendFor, a as dockerCommand, b as encryptSecrets, c as resolveHost, ct as storeDokployCredentials, f as StateStoreBusy, g as createStateStore, i as DockerPushFailed, lt as canPrompt, m as StateVersionConflict, o as validateImageRef, r as DockerBuildFailed, s as isMainFrontendApp, st as readCredentials, t as sniffAllApps, tt as validateDokployToken, ut as prompt, v as DokployApi, w as runOutput, y as DokployApiError, z as eventsBackendFor } from "./sniffer-BM8fpCas.mjs";
+import { n as gkmHome } from "./home-GI7pJl1M.mjs";
+import { a as output, o as withOutput, t as discover } from "./discover-FrYvzkeC.mjs";
+import { f as appKey, l as loadWorkspaceConfig, p as derivedApps } from "./config-C5-EEdmr.mjs";
+import { D as assertDeployedStage, a as getAppBuildOrder, b as getDeployTargetError, m as stripPublicPrefix, p as getPublicEnvPrefix, x as isDeployTargetSupported } from "./workspace-Bp1xVaOz.mjs";
+import { i as toEmbeddableSecrets, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
+import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, n as secretsStoreFor, p as isOwnedBy, u as deployIdentity } from "./store-BS8A7NcA.mjs";
+import { join, resolve } from "node:path";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
+import { createHash, randomBytes } from "node:crypto";
+import { generateKeyring } from "@geekmidas/constructs/encryption";
+import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
+import { Client } from "pg";
+import { cacheTableStatements } from "@geekmidas/cache/postgres";
+import { lookup } from "node:dns/promises";
+//#region src/deploy/credentials.ts
+/**
+* How a deploy gets the credentials it acts with.
+*
+* `deploy()` never prompts and never reads a terminal: it asks a
+* `CredentialProvider` and, when the provider has nothing, stops with
+* `MissingCredential` naming what it needed and how to supply it. Whether to
+* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
+* prompts at a terminal and stores what was typed; a CI job sets the
+* environment; a host passes its own provider.
+*/
+/** How to supply each kind, for the error that says it is missing. */
+const HOW_TO_PROVIDE = {
+	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
+	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
+};
+/** A deploy needed a credential, and its provider had none. */
+var MissingCredential = class extends Error {
+	kind;
+	target;
+	howToProvide;
+	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind]) {
+		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.`;
+		super(`${what} ${howToProvide}`);
+		this.kind = kind;
+		this.target = target;
+		this.howToProvide = howToProvide;
+		this.name = "MissingCredential";
+	}
+};
+/** Whatever was asked for, from the first provider that has it. */
+function chainCredentials(...providers) {
+	return { async get(request, options) {
+		for (const provider of providers) {
+			const found = await provider.get(request, options);
+			if (found) return found;
+		}
+	} };
+}
+/**
+* Credentials from the environment, then from what `gkm login` stored. What
+* `deploy()` uses when it is handed no provider.
+*
+* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
+*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
+*   Each half is read on its own: a token is a secret and belongs in the
+*   environment, an endpoint is configuration and belongs in the config.
+* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+*/
+function storedCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	return { async get(asked) {
+		const request = asked;
+		switch (request.kind) {
+			case "dokploy": {
+				const stored = (await readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
+				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
+				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
+				if (!token || !endpoint) return void 0;
+				return {
+					endpoint: endpoint.replace(/\/$/, ""),
+					token
+				};
+			}
+			case "registry": {
+				const username = env.DOCKER_REGISTRY_USERNAME;
+				const password = env.DOCKER_REGISTRY_PASSWORD;
+				if (!username || !password) return void 0;
+				return {
+					username,
+					password
+				};
+			}
+		}
+	} };
+}
+//#endregion
+//#region src/deploy/events.ts
+/** An error as an event carries it: its name and message, nothing else. */
+function eventError(error) {
+	if (error instanceof Error) return {
+		name: error.name,
+		message: error.message
+	};
+	return {
+		name: "Error",
+		message: String(error)
+	};
+}
+//#endregion
+//#region src/deploy/fromManifest.ts
+/**
+* The Dokploy target, read off the construct manifest.
+*
+* The AWS target has done this since `fromManifest` landed: a table keyed by
+* declaration kind, each entry turning one declaration into infrastructure and
+* the env keys it resolves. Dokploy had no such thing — it resolved environment
+* from the *sniffer*, which walks application code for `get('X')` calls, and a
+* construct reads its own key inside `@geekmidas/constructs` where there is
+* nothing to find. So a declared app deployed here got none of the model, and
+* nothing reported the absence: the deploy succeeded and the first request that
+* needed a URL failed at runtime.
+*
+* This is the same table, over the REST wrapper instead of over Pulumi.
+*
+* **Two phases, and the split is not incidental.** Creating a Postgres and
+* creating a role inside it are different kinds of act: the first is an API
+* call, the second needs a connection to a database that does not exist yet
+* when the call is made. So provisioners *accumulate* DDL rather than running
+* it, and it is applied once against a cluster that is up — which is exactly
+* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+*
+* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
+* the same generators the local target and the AWS target use. Dokploy used to
+* write its own `DO $$` block, which meant three targets applying three
+* different definitions of "the role split" and no way to notice they had
+* drifted.
+*
+* Entries are deliberately small and free of I/O ordering: each takes what it
+* needs and returns what it resolved. That is what would let a Pulumi dynamic
+* provider wrap one later without the table itself changing — see §6b.
+*/
+/**
+* The internal hostname a Dokploy Postgres answers on.
+*
+* Its own service name on the Docker network — not the server's public address.
+* An app reaching its database over the public internet would be a credential
+* crossing a network that did not need to see it.
+*/
+function clusterHost(postgres) {
+	return postgres.appName;
+}
+/**
+* What a resource is called in the provider.
+*
+* `cloudName` and nothing else — the same scoped kebab rule the AWS target
+* uses, so a name reads identically on both: `production-shop-orders`.
+*
+* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
+* is one flat list where an application and its database would collide. It is
+* not: `project.one` returns typed collections — `applications`, `postgres`,
+* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
+* the shape of the response and an application and a Postgres of the same name
+* are different objects with different ids. The suffix was answering a question
+* nobody had asked.
+*/
+function serviceName(scope, id) {
+	return cloudName(scope, id);
+}
+const PROVISIONERS = {
+	/**
+	* A Postgres service, plus the roles that reach it.
+	*
+	* The service is `findOrCreate`, because a deploy that recreated the
+	* database would be a deploy that lost the data. The roles are deferred:
+	* they need a connection to a cluster this call has only just asked for.
+	*/
+	database: async (declaration, context) => {
+		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
+		const name = resourceName(declaration.id, declaration.kind, context.stage);
+		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id), context.projectId, context.environmentId, {
+			databaseName: name,
+			databasePassword: derivedPassword(context, `${name}:master`)
+		});
+		const host = clusterHost(postgres);
+		context.clusters[postgres.databaseName] = postgres;
+		const schema = declaration.schema ?? "app";
+		const runtime = name;
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: postgres.databaseName,
+			ownsDatabase: true,
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
+		} };
+	},
+	/**
+	* A schema in the parent's database, with its own role and its own URL — so
+	* the parent's role holds no grant on these tables at all.
+	*/
+	"database-schema": async (declaration, context) => {
+		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const runtime = resourceName(declaration.id, declaration.kind, context.stage);
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: parentUrl.pathname.slice(1),
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema: declaration.schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
+		} };
+	},
+	/**
+	* A read-only endpoint on the same cluster.
+	*
+	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
+	* resolves to the writer's address — and that is safe rather than a
+	* loophole, because read-only is enforced by the reader role's grants and
+	* not by which host the URL names. The role itself was created with its
+	* parent.
+	*/
+	"database-reader": async (declaration, context) => {
+		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		const reader = readerRole(parentUrl.username);
+		return { provides: { [provideKey(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
+	},
+	/**
+	* A cache, wherever the project said it lives.
+	*
+	* `db` is a table in a database the manifest already declares, so it
+	* provisions no service and costs nothing to run — the same relationship
+	* pg-boss has. The table's DDL is deferred with the roles, and the table
+	* name travels in the URL because two caches in one database resolve the
+	* same connection string.
+	*/
+	cache: async (declaration, context) => {
+		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
+		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
+		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
+		const parent = context.provisioned[parentId];
+		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
+		const parentUrl = parent.provides[provideKey(parentId, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
+		const table = declaration.table ?? cacheTable(declaration.id);
+		const schema = schemaOf(context.manifest, parentId);
+		const qualified = schema ? `${schema}.${table}` : table;
+		context.deferred.push(...cacheTableStatements({ table: qualified }).map((statement) => ({
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: statement.describe,
+			sql: statement.sql,
+			...statement.exists ? { exists: statement.exists } : {}
+		})), {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${qualified} is owned by its schema's owner`,
+			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted(ownerRole(new URL(parentUrl).username))}`
+		}, {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
+			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
+		});
+		const url = new URL(parentUrl);
+		url.searchParams.set("table", table);
+		return { provides: { [provideKey(declaration.id, "url")]: url.toString() } };
+	},
+	/**
+	* A bucket, as a MinIO stack on the box.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* object storage, so this is the one kind whose infrastructure this target
+	* *writes* rather than configures — a compose file with one service in it.
+	*
+	* The service is named `cloudName(...)` like everything else, which is not
+	* cosmetic here: containers on `dokploy-network` resolve each other by
+	* service name, so the name is the address. Calling it `minio` would work
+	* for exactly one project on the box and then collide.
+	*
+	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
+	* reads them from an execution role, so a URL that embedded a key would be
+	* one more thing to rotate and leak. There is no role here, so the same
+	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
+	* locally.
+	*/
+	objects: async (declaration, context) => {
+		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const backend = context.storage ?? "minio";
+		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
+		const user = `${bucket}-root`;
+		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
+			service,
+			bucket,
+			user,
+			password
+		}));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[provideKey(declaration.id, "url")]: s3Url(service, bucket),
+			AWS_ACCESS_KEY_ID: user,
+			AWS_SECRET_ACCESS_KEY: password,
+			AWS_REGION: MINIO_REGION
+		} };
+	},
+	/**
+	* The address a bucket's objects are served on.
+	*
+	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
+	* behind the first would terminate TLS twice — which is why the local
+	* target's Caddy has no equivalent here. What this resolves is the address,
+	* and the `open` prefixes are applied to the bucket rather than to an edge,
+	* so a policy is what makes them public wherever the bucket lives.
+	*
+	* Until a Traefik rule exists it answers on MinIO directly, path-style,
+	* which is honest about the shape it has today: the bucket is in the path
+	* rather than fronted by a host of its own.
+	*/
+	"file-server": async (declaration, context) => {
+		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const parentUrl = context.provisioned[declaration.of]?.provides[provideKey(declaration.of, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
+		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
+		const bucket = new URL(parentUrl).hostname;
+		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
+		return { provides: { [provideKey(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* A topic, and below it a queue — the same broker either way.
+	*
+	* Under pg-boss there is nothing to create in Dokploy: the broker is a
+	* schema tenant of the database the app already declared, exactly as it is
+	* locally, so what this resolves is an address rather than a service. Which
+	* is the point of putting the backend in config — the same handlers drain
+	* pg-boss here and SQS on AWS because the string they were handed said so.
+	*
+	* The tenant gets its own role rather than the cluster master, for the
+	* reason every other tenant does: pg-boss creates and owns its tables, and
+	* a broker that could also read the application's is a broker with a grant
+	* nothing asked for.
+	*/
+	topic: async (declaration, context) => {
+		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	queue: async (declaration, context) => {
+		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	/**
+	* A signing key, generated once and remembered in the stage's store.
+	*
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
+	*/
+	secret: async (declaration, context) => {
+		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
+		const key = declaration.provides?.[0];
+		if (!key) return { provides: {} };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = provideKey(declaration.id, "credentials");
+		return { provides: {
+			[provideKey(declaration.id, "url")]: externalApiUrl(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
+	},
+	/**
+	* A surface, at the address whatever created its domain assigned.
+	*
+	* Nothing is provisioned here: the application and its domain are the
+	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
+	* Encrypt certificate. What this adds is the *derivation* — who may call it,
+	* and where a cookie it sets is readable — from the graph rather than from a
+	* hand-maintained list.
+	*/
+	"rest-api": async (declaration, context) => {
+		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
+		const url = context.addresses?.[declaration.id];
+		if (!url) throw new SurfaceHasNoAddress(declaration.id);
+		const origins = [...new Set(dependentsOf(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
+		const domain = cookieDomain([url, ...origins]);
+		const schemes = dependentsOf(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? mobileOrigins(schemeBase(context.project, app.scheme)) : [];
+		});
+		return { provides: {
+			[provideKey(declaration.id, "url")]: url,
+			[provideKey(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
+			...domain ? { [provideKey(declaration.id, "cookieDomain")]: domain } : {}
+		} };
+	}
+};
+/** The provisioner for a kind, or nothing where this target has none yet. */
+function provisionerFor(kind) {
+	return PROVISIONERS[kind];
+}
+/**
+* The role DDL for one database or tenant, from the shared generator.
+*
+* The same statements the local target applies and the same ones the AWS
+* bootstrap runs. Dokploy used to write its own, which is how three targets
+* came to hold three definitions of the same split.
+*/
+function statementsFor(options) {
+	const { id, database, runtime, owner, reader, schema, context } = options;
+	return roleStatements({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		...options.ownsDatabase ? { database } : {},
+		passwords: {
+			runtime: derivedPassword(context, runtime),
+			owner: derivedPassword(context, owner),
+			...reader ? { reader: derivedPassword(context, reader) } : {}
+		}
+	}).map((statement) => ({
+		...statement,
+		id,
+		database
+	}));
+}
+/**
+* The connection string a declared queue or topic publishes on.
+*
+* One broker for the whole project, which is what the local target does and
+* what the runtime expects: the generated pollers open a single connection and
+* subscribe each worker by name on it. So every carrier resolves to the same
+* address, and the DDL that backs it is pushed once however many are declared.
+*
+* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
+* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
+* the §4.3 question, and composing a plausible URL for either would fail at the
+* first publish instead of here.
+*/
+function broker(id, context) {
+	const backend = context.events ?? "pgboss";
+	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
+	const parentId = soleDatabase(context);
+	if (!parentId) throw new BrokerNeedsADatabase(id);
+	const parentUrl = context.provisioned[parentId]?.provides[provideKey(parentId, "url")];
+	if (!parentUrl) throw new UnresolvedParent(id, parentId);
+	const url = new URL(parentUrl);
+	const database = url.pathname.slice(1);
+	const runtime = `${database}_${PGBOSS_SCHEMA}`;
+	const owner = ownerRole(runtime);
+	if (!context.provisioned[BROKER_ID]) {
+		context.deferred.push(...statementsFor({
+			id: BROKER_ID,
+			database,
+			runtime,
+			owner,
+			schema: PGBOSS_SCHEMA,
+			context
+		}));
+		context.provisioned[BROKER_ID] = { provides: {} };
+	}
+	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
+	return { provides: { [provideKey(id, "publisherConnectionString")]: connection } };
+}
+/** The schema pg-boss creates its tables in, here as locally. */
+const PGBOSS_SCHEMA = "pgboss";
+/**
+* The id the broker's DDL is pushed under.
+*
+* Not a construct — no declaration names it — but the deferred statements need
+* an id, and every carrier in the project shares this one.
+*/
+const BROKER_ID = "PgBoss";
+/**
+* A pg-boss address: a Postgres URL under a scheme that picks the transport.
+*
+* The protocol is what a producer branches on, so it never branches — the same
+* `.publish()` reaches pg-boss here and SQS on AWS.
+*/
+function pgbossUrl(role, password, host, database) {
+	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
+}
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
+/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
+function s3Url(service, bucket) {
+	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
+}
+/**
+* A one-service compose file for a bucket.
+*
+* `dokploy-network` is external and already exists — it is what every Dokploy
+* service is attached to, and joining it is what makes the app able to resolve
+* this one by name. The bucket itself is created by MinIO's entrypoint rather
+* than by a second call, so there is nothing to reconcile afterwards.
+*/
+function minioCompose(options) {
+	const { service, bucket, user, password } = options;
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+		`    command: server /data --console-address ":9001"`,
+		"    environment:",
+		`      MINIO_ROOT_USER: ${user}`,
+		`      MINIO_ROOT_PASSWORD: ${password}`,
+		"    volumes:",
+		`      - ${service}-data:/data`,
+		"    networks:",
+		"      - dokploy-network",
+		"    healthcheck:",
+		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
+		"      interval: 10s",
+		"      retries: 5",
+		`  ${service}-bucket:`,
+		"    image: minio/mc:latest",
+		"    depends_on:",
+		`      ${service}:`,
+		"        condition: service_healthy",
+		"    entrypoint: >",
+		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
+		`      mc mb --ignore-existing s3/${bucket}"`,
+		"    networks:",
+		"      - dokploy-network",
+		"volumes:",
+		`  ${service}-data:`,
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/** Whether anything reads through a reader on this construct. */
+function readsFrom(manifest, id) {
+	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
+}
+/** The schema a database or tenant pins on its roles. */
+function schemaOf(manifest, id) {
+	const declaration = manifest[id];
+	if (declaration?.kind === "database") return declaration.schema ?? "app";
+	if (declaration?.kind === "database-schema") return declaration.schema;
+}
+/**
+* The one declared database, where `cache: 'db'` has to pick.
+*
+* Unambiguous with one and arbitrary with two, so two is an error rather than a
+* coin toss — a cache landing in a database nobody chose surfaces as entries
+* that are never found, long after the deploy reported success.
+*/
+function soleDatabase(context) {
+	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
+	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
+	return databases[0];
+}
+/**
+* A password derived from the stage's seed, the project, the stage and the role.
+*
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
+*/
+function derivedPassword(context, role) {
+	return createHash("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/** A connection string for a role on a cluster. */
+function postgresUrl(role, password, host, database) {
+	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
+}
+/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
+function quoted(name) {
+	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
+}
+/** A provisioner was handed a declaration of the wrong kind. */
+/**
+* A value only the stage's own secrets can hold.
+*
+* @throws {MissingSuppliedSecret} when the stage was never given it.
+*/
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
+}
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends Error {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
+var WrongKind = class extends Error {
+	kind;
+	constructor(kind) {
+		super(`No Dokploy provisioner handles '${kind}'`);
+		this.kind = kind;
+		this.name = "WrongKind";
+	}
+};
+/** A derived construct whose parent has not been provisioned. */
+var UnresolvedParent = class extends Error {
+	id;
+	parent;
+	constructor(id, parent) {
+		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
+		this.id = id;
+		this.parent = parent;
+		this.name = "UnresolvedParent";
+	}
+};
+/** A cache with nowhere to live. */
+var CacheNeedsAHome = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
+		this.id = id;
+		this.backend = backend;
+		this.name = "CacheNeedsAHome";
+	}
+};
+/** A `'db'` cache (a server target's default) with more than one database. */
+var CacheIsAmbiguous = class extends Error {
+	databases;
+	constructor(databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+/** A surface reached provisioning before its domain existed. */
+var SurfaceHasNoAddress = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
+		this.id = id;
+		this.name = "SurfaceHasNoAddress";
+	}
+};
+/** A queue or topic on a backend this target has no primitive for. */
+var UnprovisionableCarrier = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableCarrier";
+	}
+};
+/** A pg-boss carrier in an app that declares no database to host it. */
+var BrokerNeedsADatabase = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
+		this.id = id;
+		this.name = "BrokerNeedsADatabase";
+	}
+};
+/** A bucket on a backend this target has no primitive for. */
+var UnprovisionableBucket = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableBucket";
+	}
+};
+//#endregion
+//#region src/deploy/declared.ts
+/**
+* The declared half of a Dokploy deploy.
+*
+* `fromManifest.ts` decides what each construct resolves to; this runs it —
+* discovers the manifest, walks it parents-first, and applies the DDL the
+* provisioners deferred.
+*
+* It is deliberately separate from the engine in `index.ts`. That file deploys
+* *applications*: images, registries, domains, the things a project has whether
+* or not it declares anything. This is the part that exists because the app
+* declared it, and keeping the two apart is what lets a project adopt the model
+* without rewriting its deploy — and lets this one be tested without one.
+*/
+/**
+* Provision everything the workspace declares, and return what it resolved.
+*/
+async function provisionDeclared(options) {
+	const { workspace } = options;
+	const empty = {
+		env: {},
+		statements: [],
+		provisioned: {},
+		clusters: {}
+	};
+	const manifest = options.manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	if (Object.keys(manifest).length === 0) return empty;
+	const context = {
+		manifest,
+		provisioned: {},
+		api: options.api,
+		projectId: options.projectId,
+		environmentId: options.environmentId,
+		stage: options.stage,
+		project: workspace.name,
+		scope: options.scope ?? workspace.name,
+		cache: cacheBackendFor(providerOf(workspace)),
+		events: eventsBackendFor(providerOf(workspace)),
+		storage: storageBackendFor(providerOf(workspace)),
+		addresses: surfaceAddresses(manifest, options.appUrls),
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
+		deferred: [],
+		clusters: {}
+	};
+	const env = {};
+	for (const id of carriersLast(provisionOrder(manifest), manifest)) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const provisioner = provisionerFor(declaration.kind);
+		if (!provisioner) continue;
+		const result = await provisioner(declaration, context);
+		context.provisioned[id] = result;
+		Object.assign(env, result.provides);
+	}
+	return {
+		env,
+		statements: context.deferred.map((statement) => ({
+			id: statement.id,
+			describe: statement.describe,
+			...statement.database ? { database: statement.database } : {},
+			...statement.exists ? { exists: statement.exists } : {},
+			create: statement.sql
+		})),
+		provisioned: context.provisioned,
+		clusters: context.clusters
+	};
+}
+/**
+* Run the deferred DDL against a cluster that is now reachable.
+*
+* The same applier the local target uses: every statement asks whether it is
+* needed first, so a redeploy is free and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclared(client, statements) {
+	return (await applyPostgres(client, statements)).filter((entry) => entry.created).length;
+}
+/**
+* The provisioning order, with queues and topics moved to the end.
+*
+* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
+* *derived from* a database, because under SNS it does not live in one. Where
+* it lives is a fact about the backend, which is config — so the dependency is
+* real under pg-boss and absent under SNS, and writing it into the declaration
+* would state it in the one place that cannot know.
+*
+* Here it can. This runs where the backend is known, and the rule needs no
+* branch on it: nothing depends on a carrier. A queue's worker and a topic's
+* subscribers are *bound* to it rather than dependent on it, which is why
+* neither holds a key of its own — so a carrier can always go last, and under
+* pg-boss that is exactly late enough for the database it reads to be there.
+*/
+function carriersLast(ordered, manifest) {
+	const carries = (id) => {
+		const kind = manifest[id]?.kind;
+		return kind === "queue" || kind === "topic";
+	};
+	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
+}
+/**
+* Where each declared surface answers: its own app's address.
+*
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
+*/
+function surfaceAddresses(manifest, appUrls) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[appKey(id)];
+		if (url) addresses[id] = url;
+	}
+	return addresses;
+}
+//#endregion
+//#region src/deploy/state.ts
+/**
+* Create a new empty state for a stage
+*/
+function createEmptyState(stage, projectId, environmentId) {
+	return {
+		provider: "dokploy",
+		stage,
+		projectId,
+		environmentId,
+		applications: {},
+		services: {},
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Set application ID in state (mutates state)
+*/
+function setApplicationId(state, appName, applicationId) {
+	state.applications[appName] = applicationId;
+}
+/**
+* Record the image an app was deployed with (mutates state)
+*/
+function setDeployedImage(state, appName, image) {
+	state.images = {
+		...state.images,
+		[appName]: image
+	};
+}
+/**
+* Get a generated secret for an app
+*/
+function getGeneratedSecret(state, appName, secretName) {
+	return state?.generatedSecrets?.[appName]?.[secretName];
+}
+/**
+* Set a generated secret for an app (mutates state)
+*/
+function setGeneratedSecret(state, appName, secretName, value) {
+	if (!state.generatedSecrets) state.generatedSecrets = {};
+	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
+	state.generatedSecrets[appName][secretName] = value;
+}
+/**
+* Set DNS verification record for a hostname (mutates state)
+*/
+function setDnsVerification(state, hostname, serverIp) {
+	if (!state.dnsVerified) state.dnsVerified = {};
+	state.dnsVerified[hostname] = {
+		serverIp,
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Check if a hostname is already verified with the given IP
+*/
+function isDnsVerified(state, hostname, serverIp) {
+	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
+}
+/**
+* Get the key for a DNS record in state
+*/
+function getDnsRecordKey(name, type) {
+	return `${name}:${type}`;
+}
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Get backup state from state
+*/
+function getBackupState(state) {
+	return state?.backups;
+}
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
+}
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
+}
+//#endregion
+//#region src/deploy/dns/DnsProvider.ts
+/**
+* Check if value is a DnsProvider implementation.
+*/
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+}
+/**
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
+*/
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await import("./HostingerProvider-DgzKa_Tj.mjs");
+		return new HostingerProvider();
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await import("./Route53Provider-Cvj40A8I.mjs");
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
+		});
+	}
+	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
+	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
+}
+//#endregion
+//#region src/deploy/dns/index.ts
+/**
+* DNS orchestration for deployments
+*
+* Handles automatic DNS record creation for deployed applications.
+*/
+const logger$3 = output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
+}
+/**
+* Normalize DNS config to new multi-domain format
+*/
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
+	}
+	return config;
+}
+/**
+* Find the root domain for a hostname from available DNS configs
+*
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
+*/
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
+}
+/**
+* Group hostnames by their root domain
+*/
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$3.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
+	}
+	return grouped;
+}
+/**
+* Resolve IP address from a hostname
+*/
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await lookup(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
+*/
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
+}
+/**
+* Generate required DNS records for a deployment
+*/
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
+}
+/**
+* Print DNS records table
+*/
+function printDnsRecordsTable(records, rootDomain) {
+	logger$3.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$3.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$3.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$3.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$3.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+	}
+	logger$3.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+}
+/**
+* Print DNS records in a simple format for manual setup
+*/
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$3.log("\n   📋 Required DNS Records:");
+	logger$3.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$3.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$3.log("");
+}
+/**
+* Create DNS records for a single domain using its configured provider
+*/
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$3.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
+	}
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
+	try {
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$3.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
+	}
+	return results;
+}
+/**
+* Main DNS orchestration function for deployments
+*
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+*
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
+*/
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$3.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$3.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$3.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
+	}
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$3.log("   No DNS records needed (no hostnames match configured domains)");
+		return {
+			records: [],
+			success: true,
+			serverIp
+		};
+	}
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$3.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
+		}
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$3.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$3.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$3.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$3.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+	}
+	return {
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
+	};
+}
+/**
+* Verify DNS records resolve correctly after deployment.
+*
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
+*/
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$3.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (isDnsVerified(state, hostname, serverIp)) {
+			logger$3.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				setDnsVerification(state, hostname, serverIp);
+				logger$3.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$3.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$3.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
+			});
+		}
+	}
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$3.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$3.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$3.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
+}
+//#endregion
+//#region src/deploy/docker.ts
+const logger$2 = output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
+	const path = join(dir, CREDENTIALS_SECRET_ID);
+	await writeFile(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
+	await chmod(path, 384);
+	return {
+		path,
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
+	logger$2.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$2.log("   Generating Dockerfile for the pre-built bundle...");
+	await dockerCommand({
+		slim: true,
+		cwd
+	});
+	const dockerfilePath = join(cwd, ".gkm", "docker", "Dockerfile");
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs,
+			credentialsFile: secret?.path
+		}), {
+			cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$2.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$2.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$2.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	const docker = {
+		cwd: options.cwd ?? process.cwd(),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$2.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$2.log("\n✅ Docker deployment ready!");
+	logger$2.log(`\n📋 Deployment details:`);
+	logger$2.log(`   Image: ${imageRef}`);
+	logger$2.log(`   Stage: ${stage}`);
+	if (masterKey) logger$2.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
+//#region src/deploy/env-resolver.ts
+/**
+* Environment Variable Resolution for Dokploy Deployments
+*
+* Resolves sniffed environment variables to actual values during deployment.
+* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
+* and falls back to user-provided secrets.
+*/
+/**
+* Generate a secure random secret (64 hex characters = 32 bytes)
+*/
+function generateSecret() {
+	return randomBytes(32).toString("hex");
+}
+/**
+* Get or generate a secret for an app.
+* If the secret already exists in state, returns it.
+* Otherwise generates a new one and stores it.
+*/
+function getOrGenerateSecret(state, appName, secretName) {
+	const existing = getGeneratedSecret(state, appName, secretName);
+	if (existing) return existing;
+	const generated = generateSecret();
+	setGeneratedSecret(state, appName, secretName, generated);
+	return generated;
+}
+/**
+* Resolve a single environment variable
+*/
+function resolveEnvVar(varName, context) {
+	switch (varName) {
+		case "PORT": return String(context.app.port);
+		case "NODE_ENV": return "production";
+		case "STAGE": return context.stage;
+		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
+		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
+		case "BETTER_AUTH_TRUSTED_ORIGINS":
+			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
+			break;
+		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
+	}
+	if (context.dependencyUrls && varName.endsWith("_URL")) {
+		const depName = (stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
+		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
+	}
+	if (context.userSecrets) {
+		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
+		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
+		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
+		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
+	}
+}
+/**
+* Resolve all environment variables for an app
+*/
+function resolveEnvVars(requiredVars, context) {
+	const resolved = {};
+	const missing = [];
+	for (const varName of requiredVars) {
+		const value = resolveEnvVar(varName, context);
+		if (value !== void 0) resolved[varName] = value;
+		else missing.push(varName);
+	}
+	return {
+		resolved,
+		missing
+	};
+}
+/**
+* Format missing variables error message
+*/
+function formatMissingVarsError(appName, missing, stage) {
+	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+}
+/**
+* Validate that all required environment variables can be resolved
+*/
+function validateEnvVars(requiredVars, context) {
+	const { resolved, missing } = resolveEnvVars(requiredVars, context);
+	return {
+		valid: missing.length === 0,
+		missing,
+		resolved
+	};
+}
+//#endregion
+//#region src/deploy/generated.ts
+/**
+* The values a deployed stage generates once and keeps: what nothing can
+* provision and nobody else issues.
+*
+* - **A seed**, which salts every password a deploy derives — a database's
+*   master and roles, a bucket's root user. Derived from repo facts alone
+*   (project, stage, construct id), those passwords were computable by anyone
+*   who could read the repo.
+* - **Each `secret` construct's value** — an auth server's signing secret —
+*   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
+*
+* Both are generated on the first deploy that needs them and written to the
+* stage's store, so every later deploy reads the same values: sessions survive
+* a redeploy, and a role's password does not move. A value set by hand with
+* `gkm secrets:set` is kept, never replaced.
+*/
+/**
+* The stage's secrets with its seed and every declared `secret`'s value
+* present, generating what is missing. Pure: the caller writes the result
+* back to the stage's store when `generated` is not empty.
+*/
+function withGeneratedSecrets(secrets, manifest) {
+	const generated = [];
+	const custom = { ...secrets.custom };
+	for (const declaration of Object.values(manifest)) {
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
+		const key = declaration.provides?.[0];
+		if (!key || custom[key]) continue;
+		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
+		generated.push(key);
+	}
+	const seed = secrets.seed ?? random();
+	if (!secrets.seed) generated.push("seed");
+	return {
+		secrets: generated.length ? {
+			...secrets,
+			seed,
+			custom,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : secrets,
+		generated
+	};
+}
+/** 256 bits, URL-safe. */
+function random() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
+	stage;
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
+		this.stage = stage;
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	/**
+	* The stage's journal — its stored state, or `initial` written as the
+	* stage's first state, so there is somewhere to record the very first
+	* resource before it is created.
+	*/
+	static async open(store, stage, initial) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
+		});
+	}
+	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
+		});
+	}
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
+		}
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
+		}
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
+		};
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	}
+};
+//#endregion
+//#region src/deploy/ownership.ts
+/**
+* Which Dokploy project a deploy is allowed to deploy into.
+*
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
+*/
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The project this identity owns, if there is one — read only, so a dry run
+* asks the same question a deploy does:
+*
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project.
+* 2. One with this name *and* this identity's marker.
+*
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
+*/
+async function findProject(api, identity, stateProjectId) {
+	const name = projectName(identity);
+	const marker = ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				description: known.description ?? null,
+				environments: known.environments ?? [],
+				via: "state",
+				needsClaim: !claimed
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			description: owned.description ?? null,
+			environments: details.environments ?? [],
+			via: "marker",
+			needsClaim: false
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	return null;
+}
+/**
+* The project this deploy deploys into: the one {@link findProject} finds —
+* claimed with this identity's marker if it carries none yet, so the next
+* deploy without state still finds it — or a new one, marked.
+*/
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const marker = ownershipMarker(identity);
+	const found = await findProject(api, identity, stateProjectId);
+	if (found) {
+		if (found.needsClaim) {
+			await api.updateProject(found.projectId, {
+				name: found.name,
+				description: withMarker(found.description, marker)
+			});
+			log(`   Claimed project ${found.name} for ${identity.key}`);
+		}
+		return {
+			projectId: found.projectId,
+			name: found.name,
+			environments: found.environments,
+			via: found.via
+		};
+	}
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(projectName(identity), withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
+}
+//#endregion
+//#region src/deploy/registry.ts
+/**
+* Which Dokploy registry a stage's images are pulled through.
+*
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
+*/
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.dokploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		this.stage = stage;
+		this.name = "RegistryNotConfigured";
+	}
+};
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
+	}
+};
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
+	}
+};
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
+	}
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
+//#region src/deploy/secrets.ts
+/**
+* Filter secrets to only include the env vars that an app requires.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Filtered secrets with found/missing tracking
+*/
+function filterSecretsForApp(stageSecrets, sniffedEnv) {
+	const allSecrets = toEmbeddableSecrets(stageSecrets);
+	const filtered = {};
+	const found = [];
+	const missing = [];
+	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
+		filtered[key] = allSecrets[key];
+		found.push(key);
+	} else missing.push(key);
+	return {
+		appName: sniffedEnv.appName,
+		secrets: filtered,
+		found: found.sort(),
+		missing: missing.sort()
+	};
+}
+/**
+* Encrypt filtered secrets for an app.
+* Generates an ephemeral master key that should be injected into Dokploy.
+*
+* @param filteredSecrets - The filtered secrets for the app
+* @returns Encrypted payload with master key
+*/
+function encryptSecretsForApp(filteredSecrets) {
+	const payload = encryptSecrets(filteredSecrets.secrets);
+	return {
+		appName: filteredSecrets.appName,
+		payload,
+		masterKey: payload.masterKey,
+		secretCount: Object.keys(filteredSecrets.secrets).length,
+		missingSecrets: filteredSecrets.missing
+	};
+}
+/**
+* Filter and encrypt secrets for an app in one step.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Encrypted secrets with master key
+*/
+function prepareSecretsForApp(stageSecrets, sniffedEnv) {
+	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+}
+/**
+* Prepare secrets for multiple apps.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedApps - Map of app name to sniffed environment
+* @returns Map of app name to encrypted secrets
+*/
+function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
+		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
+		results.set(appName, encrypted);
+	}
+	return results;
+}
+/**
+* Generate a report on secrets preparation.
+*/
+function generateSecretsReport(encryptedApps, sniffedApps) {
+	const appsWithSecrets = [];
+	const appsWithoutSecrets = [];
+	const appsWithMissingSecrets = [];
+	for (const [appName, sniffedEnv] of sniffedApps) {
+		if (sniffedEnv.requiredEnvVars.length === 0) {
+			appsWithoutSecrets.push(appName);
+			continue;
+		}
+		const encrypted = encryptedApps.get(appName);
+		if (encrypted) {
+			appsWithSecrets.push(appName);
+			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
+				appName,
+				missing: encrypted.missingSecrets
+			});
+		}
+	}
+	return {
+		totalApps: sniffedApps.size,
+		appsWithSecrets: appsWithSecrets.sort(),
+		appsWithoutSecrets: appsWithoutSecrets.sort(),
+		appsWithMissingSecrets
+	};
+}
+//#endregion
+//#region src/deploy/terminal.ts
+/**
+* The credentials `gkm deploy` can ask a person for. CLI layer only.
+*
+* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
+* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
+* this provider reads the environment and the stored login first, and only
+* when both are empty prompts — and stores a Dokploy login it validated, so
+* the next deploy does not ask again. With no terminal it answers nothing, and
+* the deploy says what was missing instead of waiting on a prompt nobody sees.
+*/
+const logger$1 = output;
+/** What answers a deploy prompt without a terminal. */
+const INSTEAD = "Please configure manually.";
+/** The Dokploy URL typed at the prompt is not a URL. */
+var DokployEndpointInvalid = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid URL format");
+		this.endpoint = endpoint;
+		this.name = "DokployEndpointInvalid";
+	}
+};
+/** Dokploy refused the token typed at the prompt; nothing was stored. */
+var DokployTokenRejected = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid credentials. Please check your token.");
+		this.endpoint = endpoint;
+		this.name = "DokployTokenRejected";
+	}
+};
+/** Asks the person at the terminal for what nothing else supplied. */
+function asking() {
+	return { async get(asked) {
+		if (!canPrompt()) return void 0;
+		const request = asked;
+		if (request.kind === "dokploy") {
+			logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
+			const endpoint = (await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
+			try {
+				new URL(endpoint);
+			} catch {
+				throw new DokployEndpointInvalid(endpoint);
+			}
+			logger$1.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			const token = await prompt("API Token: ", {
+				hidden: true,
+				instead: INSTEAD
+			});
+			logger$1.log("\nValidating credentials...");
+			if (!await validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
+			await storeDokployCredentials(token, endpoint);
+			logger$1.log("✓ Credentials saved");
+			return {
+				endpoint,
+				token
+			};
+		}
+		logger$1.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
+		return {
+			username: await prompt("Registry username: ", { instead: INSTEAD }),
+			password: await prompt("Registry password/token: ", {
+				hidden: true,
+				instead: INSTEAD
+			})
+		};
+	} };
+}
+/**
+* The environment, then the stored login, then — at a terminal — the person
+* running the command.
+*/
+function terminalCredentials(base = storedCredentials()) {
+	return chainCredentials(base, asking());
+}
+//#endregion
+//#region src/deploy/index.ts
+/**
+* Deploy Module
+*
+* Handles deployment of GKM workspaces to various providers (Docker, Dokploy).
+*
+* ## Per-App Database Credentials
+*
+* When deploying to Dokploy with Postgres, this module creates per-app database
+* users with isolated schemas. This follows the same pattern as local dev mode
+* (docker/postgres/init.sh).
+*
+* ### How It Works
+*
+* 1. **Provisioning**: Creates Postgres service with master credentials
+* 2. **User Creation**: For each backend app that needs DATABASE_URL:
+*    - Generates a unique password (stored in deploy state)
+*    - Creates a database user with that password
+*    - Assigns schema permissions based on app name
+* 3. **Schema Assignment**:
+*    - `api` app: Uses `public` schema (shared tables)
+*    - Other apps (e.g., `auth`): Get their own schema with `search_path` set
+* 4. **Environment Injection**: Each app receives its own DATABASE_URL
+*
+* ### Security
+*
+* - External Postgres port is enabled only during user creation, then disabled
+* - Each app can only access its own schema
+* - Credentials are stored in `.gkm/deploy-{stage}.json` (gitignored)
+* - Subsequent deploys reuse existing credentials from state
+*
+* ### Example Flow
+*
+* ```
+* gkm deploy --stage production
+*   ├─ Create Postgres (user: postgres, db: myproject)
+*   ├─ Enable external port temporarily
+*   ├─ Create user "api" → public schema
+*   ├─ Create user "auth" → auth schema (search_path=auth)
+*   ├─ Disable external port
+*   ├─ Deploy "api" with DATABASE_URL=postgresql://api:xxx@postgres:5432/myproject
+*   └─ Deploy "auth" with DATABASE_URL=postgresql://auth:yyy@postgres:5432/myproject
+* ```
+*
+* @module deploy
+*/
+const logger = output;
+/**
+* Wait for Postgres to be ready to accept connections.
+*
+* Polls the Postgres server until it accepts a connection or max retries reached.
+* Used after enabling the external port to ensure the database is accessible
+* before creating users.
+*
+* @param host - The Postgres server hostname
+* @param port - The external port (typically 5432)
+* @param user - Master database user (postgres)
+* @param password - Master database password
+* @param database - Database name to connect to
+* @param maxRetries - Maximum number of connection attempts (default: 30)
+* @param retryIntervalMs - Milliseconds between retries (default: 2000)
+* @throws Error if Postgres is not ready after maxRetries
+*/
+async function waitForPostgres(host, port, user, password, database, maxRetries = 30, retryIntervalMs = 2e3) {
+	for (let i = 0; i < maxRetries; i++) try {
+		const client = new Client({
+			host,
+			port,
+			user,
+			password,
+			database,
+			connectionTimeoutMillis: 5e3
+		});
+		client.on("error", () => {});
+		await client.connect();
+		await client.end();
+		return;
+	} catch {
+		if (i < maxRetries - 1) {
+			logger.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			await new Promise((r) => setTimeout(r, retryIntervalMs));
+		}
+	}
+	throw new PostgresNotReady(host, port, maxRetries);
+}
+/** A Postgres published for the role DDL never accepted a connection. */
+var PostgresNotReady = class extends Error {
+	host;
+	port;
+	attempts;
+	constructor(host, port, attempts) {
+		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
+		this.host = host;
+		this.port = port;
+		this.attempts = attempts;
+		this.name = "PostgresNotReady";
+	}
+};
+/** No port could be published for a cluster, so its DDL cannot reach it. */
+var PostgresPortUnavailable = class extends Error {
+	appName;
+	taken;
+	constructor(appName, taken) {
+		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
+		this.appName = appName;
+		this.taken = taken;
+		this.name = "PostgresPortUnavailable";
+	}
+};
+/**
+* Run the manifest's DDL against a Dokploy Postgres.
+*
+* The cluster is only reachable from outside while an external port is
+* published, so this opens one, applies, and leaves it as it found it. The
+* alternative — running DDL from inside the network — needs a container to run
+* it in, which is what `DatabaseBootstrap` is on AWS and what a Dokploy target
+* has no equivalent for yet.
+*
+* The applier is the local target's, so every statement asks whether it is
+* needed first: a redeploy is free, and a half-applied run recovers by being
+* run again.
+*/
+/**
+* A high port for one service, the same one every time.
+*
+* Derived from the service name rather than random so two deploys of the same
+* database agree and two different databases do not collide — and in the
+* ephemeral range, above anything a server is likely to have bound
+* deliberately.
+*/
+function derivedPort(appName) {
+	const digest = createHash("sha256").update(appName).digest();
+	return 49152 + (digest[0] << 8 | digest[1]) % 16e3;
+}
+async function applyDeclaredStatements(api, postgres, serverHostname, statements) {
+	let externalPort = await api.getPostgres(postgres.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
+	const opened = externalPort === void 0;
+	if (externalPort === void 0) {
+		const taken = await api.publishedPorts().catch(() => /* @__PURE__ */ new Set());
+		const candidates = [5432, derivedPort(postgres.appName)].filter((port) => !taken.has(port));
+		for (const candidate of candidates) try {
+			await api.savePostgresExternalPort(postgres.postgresId, candidate);
+			externalPort = candidate;
+			break;
+		} catch (error) {
+			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
+			logger.log(`   Port ${candidate} is taken; trying another...`);
+		}
+		if (externalPort === void 0) throw new PostgresPortUnavailable(postgres.appName, [...taken]);
+		logger.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
+	}
+	await api.deployPostgres(postgres.postgresId);
+	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
+	const client = { async query(database, sql, values) {
+		const connection = new Client({
+			host: serverHostname,
+			port: externalPort,
+			user: postgres.databaseUser,
+			password: postgres.databasePassword,
+			database: database ?? postgres.databaseName,
+			connectionTimeoutMillis: 15e3
+		});
+		connection.on("error", () => {});
+		await connection.connect();
+		try {
+			return (await connection.query(sql, values)).rows;
+		} finally {
+			await connection.end();
+		}
+	} };
+	const unpublish = async () => {
+		if (!opened) return;
+		await api.savePostgresExternalPort(postgres.postgresId, null).then(() => api.deployPostgres(postgres.postgresId)).catch(() => {
+			logger.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
+		});
+	};
+	let lastError;
+	try {
+		for (let attempt = 1; attempt <= 3; attempt++) try {
+			return await applyDeclared(client, statements);
+		} catch (error) {
+			lastError = error;
+			if (attempt === 3) break;
+			const message = error instanceof Error ? error.message : String(error);
+			logger.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+			await new Promise((resolve) => setTimeout(resolve, 1e4));
+			await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName).catch(() => {});
+		}
+		throw lastError;
+	} finally {
+		await unpublish();
+	}
+}
+/**
+* Get the server hostname from the Dokploy endpoint URL
+*/
+function getServerHostname(endpoint) {
+	return new URL(endpoint).hostname;
+}
+/**
+* Generate image tag from stage and timestamp
+*/
+function generateTag(stage) {
+	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
+}
+/**
+* The things this deploy creates a container for.
+*
+* A deploy unit is a *declaration*, not a config entry — and since that is now
+* true of every app, not just the ones being deployed, this is the workspace's
+* own derivation under the name the deploy phases call it by.
+*/
+function deployUnits(manifest, workspace) {
+	return derivedApps(manifest, workspace);
+}
+/**
+* The variables an app cannot start without.
+*
+* The sniffer reports every key it saw in `requiredEnvVars` and says which of
+* them were read through `.optional()` or `.default()` in `optionalEnvVars`.
+* Reading only the first treats a key that is *absent by design* as a missing
+* secret — `AUTH_COOKIE_DOMAIN` is published only when a surface has a domain
+* to widen a cookie to, and one host has nothing to share it with.
+*
+* The same distinction `bundleServer` draws. It is drawn twice because the
+* bundle and the deploy each validate, and the deploy was the half still
+* failing on an answer that was correct.
+*/
+function requiredOf(requirements) {
+	if (!requirements) return [];
+	const optional = new Set(requirements.optionalEnvVars);
+	return requirements.requiredEnvVars.map((name) => name.endsWith("?") ? name.slice(0, -1) : name).filter((name) => !optional.has(name));
+}
+/** Apps were asked for by name that the workspace does not have. */
+var UnknownDeployApps = class extends Error {
+	apps;
+	available;
+	constructor(apps, available) {
+		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
+		this.apps = apps;
+		this.available = available;
+		this.name = "UnknownDeployApps";
+	}
+};
+/** Every app asked for deploys somewhere other than Dokploy. */
+var NoDeployableApps = class extends Error {
+	stage;
+	constructor(stage) {
+		super("No apps to deploy. All selected apps have unsupported deploy targets.");
+		this.stage = stage;
+		this.name = "NoDeployableApps";
+	}
+};
+/** A backend failed, so the run stopped before deploying anything after it. */
+var BackendDeployFailed = class extends Error {
+	app;
+	constructor(app, cause) {
+		super(`Backend deployment failed for ${app}. Aborting to prevent partial deployment.`, { cause });
+		this.app = app;
+		this.name = "BackendDeployFailed";
+	}
+};
+/** An app's environment needs values the stage does not have. */
+var MissingEnvVars = class extends Error {
+	app;
+	missing;
+	stage;
+	constructor(app, missing, stage) {
+		super(formatMissingVarsError(app, [...missing], stage));
+		this.app = app;
+		this.missing = missing;
+		this.stage = stage;
+		this.name = "MissingEnvVars";
+	}
+};
+/** Workspace deploys go to Dokploy; another provider was asked for. */
+var DeployProviderUnsupported = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`Workspace deployment only supports Dokploy. Got: ${provider}`);
+		this.provider = provider;
+		this.name = "DeployProviderUnsupported";
+	}
+};
+/** How `resolveProject` found a project, in the journal's words. */
+const PROJECT_VIA = {
+	state: "recorded",
+	marker: "found",
+	created: "created"
+};
+/**
+* Deploy every app in a workspace to Dokploy.
+*
+* Two-phase orchestration:
+* - PHASE 1: Deploy backend apps (with encrypted secrets)
+* - PHASE 2: Deploy frontend apps (with public URLs from backends)
+*
+* Security model:
+* - Backend apps get encrypted secrets embedded at build time
+* - Only GKM_MASTER_KEY is injected as Dokploy env var
+* - Frontend apps get public URLs baked in at build time (no secrets)
+*
+* The engine under `deploy()` and `gkm deploy`. It never prompts and never
+* exits: credentials come from `ctx.credentials`, progress goes to
+* `ctx.emit` and to `output`, and every failure is thrown.
+*
+* @internal
+*/
+async function runDeploy(source, request, ctx) {
+	const { stage, tag, apps: selectedApps } = request;
+	ctx.emit({
+		type: "phase.started",
+		phase: "validate"
+	});
+	const configured = typeof source === "function" ? await source() : source;
+	const manifest = await discover({
+		patterns: constructGlobs(configured),
+		cwd: configured.root
+	});
+	const units = deployUnits(manifest, configured);
+	const workspace = Object.keys(units).length > 0 ? {
+		...configured,
+		apps: units
+	} : configured;
+	const identity = deployIdentity(workspace, stage);
+	logger.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
+	logger.log(`   Stage: ${stage}`);
+	const imageTag = tag ?? generateTag(stage);
+	logger.log(`   Tag: ${imageTag}`);
+	const buildOrder = getAppBuildOrder(workspace);
+	let appsToDeployNames = buildOrder;
+	if (selectedApps && selectedApps.length > 0) {
+		const invalidApps = selectedApps.filter((name) => !workspace.apps[name]);
+		if (invalidApps.length > 0) throw new UnknownDeployApps(invalidApps, Object.keys(workspace.apps));
+		appsToDeployNames = buildOrder.filter((name) => selectedApps.includes(name));
+		logger.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
+	} else logger.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
+	const skipped = [];
+	const skip = (app, reason) => {
+		skipped.push({
+			app,
+			reason
+		});
+		ctx.emit({
+			type: "app.skipped",
+			app,
+			reason
+		});
+	};
+	const dokployApps = appsToDeployNames.filter((name) => {
+		const target = workspace.apps[name].resolvedDeployTarget;
+		if (target === "sst") {
+			const reason = `it deploys with SST — run \`gkm build && sst deploy --stage ${stage}\``;
+			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
+			skip(name, reason);
+			return false;
+		}
+		if (!isDeployTargetSupported(target)) {
+			const reason = getDeployTargetError(target, name);
+			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
+			skip(name, reason);
+			return false;
+		}
+		return true;
+	});
+	if (dokployApps.length === 0) throw new NoDeployableApps(stage);
+	appsToDeployNames = dokployApps;
+	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") skip(name, MOBILE_SKIP_REASON);
+	ctx.emit({
+		type: "deploy.started",
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		apps: appsToDeployNames.filter((name) => workspace.apps[name].type !== "mobile"),
+		dryRun: ctx.dryRun
+	});
+	const store = await createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
+	const run = {
+		workspace,
+		manifest,
+		stage,
+		imageTag,
+		appsToDeployNames,
+		identity,
+		store,
+		skipped,
+		ctx
+	};
+	if (ctx.dryRun) return planDeploy(run);
+	const lock = await store.lock(stage, { operation: "deploy" });
+	try {
+		return await deployLocked(run);
+	} finally {
+		await lock.release();
+	}
+}
+/**
+* The stage's secrets and every app's environment requirements. A dry run
+* reads the secrets and generates nothing into the store.
+*/
+async function preflight({ workspace, manifest, stage, ctx }) {
+	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
+	const secretsStore = await secretsStoreFor(workspace, stage, { ...ctx.home ? { home: ctx.home } : {} });
+	const stored = await secretsStore.read(stage);
+	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
+	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	if (generated.length > 0) {
+		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		else {
+			await secretsStore.write(stage, stageSecrets);
+			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		}
+	}
+	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
+	const encryptedSecrets = stageSecrets ? prepareSecretsForAllApps(stageSecrets, sniffedApps) : /* @__PURE__ */ new Map();
+	if (stageSecrets) {
+		const report = generateSecretsReport(encryptedSecrets, sniffedApps);
+		if (report.appsWithSecrets.length > 0) logger.log(`   ✓ Encrypted secrets for: ${report.appsWithSecrets.join(", ")}`);
+		if (report.appsWithMissingSecrets.length > 0) for (const { appName, missing } of report.appsWithMissingSecrets) logger.log(`   ⚠️  ${appName}: Missing secrets: ${missing.join(", ")}`);
+	}
+	return {
+		stageSecrets,
+		sniffedApps,
+		encryptedSecrets
+	};
+}
+/** Everything a deploy does while it holds the stage's lock. */
+async function deployLocked(run) {
+	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity, store, ctx } = run;
+	const { stageSecrets, sniffedApps, encryptedSecrets } = await preflight(run);
+	ctx.emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	const changes = [];
+	const applied = (change, via) => {
+		changes.push(change);
+		ctx.emit({
+			type: "resource.applied",
+			...change,
+			via
+		});
+	};
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "provision"
+	});
+	const { api, endpoint } = await dokployApi(workspace, ctx);
+	logger.log("\n📋 Loading deploy state...");
+	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
+	const state = journal.state;
+	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
+	else logger.log(`   Creating new state for stage "${stage}"`);
+	const unfinished = journal.unfinished();
+	if (unfinished.length > 0) logger.log(`   ⚠ A previous run stopped while creating: ${unfinished.join(", ")} — looking for them before creating anything`);
+	logger.log("\n📁 Setting up Dokploy project...");
+	logger.log(`   Identity: ${identity.key}`);
+	const projectEntry = {
+		key: "project",
+		type: "project",
+		data: {
+			name: projectName(identity),
+			identity: identity.key
+		}
+	};
+	const project = await resolveProject(api, identity, state.projectId || void 0, (message) => logger.log(message), { beforeCreate: () => journal.pending(projectEntry) });
+	await journal.ready(projectEntry, project.projectId);
+	applied({
+		key: "project",
+		resourceType: "project",
+		action: project.via === "created" ? "create" : "reuse",
+		id: project.projectId
+	}, PROJECT_VIA[project.via]);
+	if (project.via === "created") logger.log(`   ✓ Created project: ${project.projectId}`);
+	else logger.log(`   Found existing project: ${project.name}`);
+	const environmentEntry = {
+		key: "environment",
+		type: "environment",
+		data: { name: stage }
+	};
+	const environment = await journal.ensure(environmentEntry, {
+		find: async () => project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase()),
+		create: () => {
+			logger.log(`   Creating "${stage}" environment...`);
+			return api.createEnvironment(project.projectId, stage);
+		},
+		id: (e) => e.environmentId
+	});
+	const environmentId = environment.resource.environmentId;
+	applied({
+		key: "environment",
+		resourceType: "environment",
+		action: environment.via === "created" ? "create" : "reuse",
+		id: environmentId
+	}, environment.via);
+	if (environment.via === "created") logger.log(`   ✓ Created environment: ${stage}`);
+	else logger.log(`   Using environment: ${environment.resource.name}`);
+	if (journal.existed) {
+		if (state.projectId && state.projectId !== project.projectId) logger.log(`   ⚠ Project ID changed, updating state`);
+		if (state.environmentId && state.environmentId !== environmentId) logger.log(`   ⚠ Environment ID changed, updating state`);
+	}
+	state.projectId = project.projectId;
+	state.environmentId = environmentId;
+	state.identity = identity.key;
+	logger.log("\n🐳 Checking registry...");
+	const registry = workspace.deploy.dokploy?.registry;
+	let registryCreated = false;
+	const dokployRegistry = await resolveRegistry(api, {
+		stage,
+		registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state.registryId,
+		log: (message) => logger.log(message),
+		create: async (url) => {
+			const login = await ctx.credentials.get({
+				kind: "registry",
+				url
+			}, { signal: ctx.signal });
+			if (!login) throw new MissingCredential("registry", url);
+			const created = await api.createRegistry("Default Registry", url, login.username, login.password);
+			registryCreated = true;
+			logger.log(`   ✓ Registry created: ${created.registryId}`);
+			return created;
+		}
+	});
+	const registryId = dokployRegistry.registryId;
+	state.registryId = registryId;
+	applied({
+		key: "registry",
+		resourceType: "registry",
+		action: registryCreated ? "create" : "reuse",
+		id: registryId
+	}, registryCreated ? "created" : "found");
+	logger.log(`   Using registry: ${dokployRegistry.registryName}`);
+	await journal.save();
+	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
+	if (skippedMobileApps.length > 0) logger.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
+	let declaredEnv = {};
+	let declaredClusters = {};
+	{
+		logger.log("\n📦 Provisioning declared constructs...");
+		const appUrls = {};
+		for (const appName of appsToDeployNames) {
+			if (workspace.apps[appName]?.type !== "backend") continue;
+			appUrls[appName] = `https://${hostOf(workspace, appName, stage)}`;
+		}
+		const declared = await provisionDeclared({
+			api,
+			workspace,
+			projectId: project.projectId,
+			environmentId,
+			stage,
+			scope: identity.scope,
+			appUrls,
+			supplied: stageSecrets.custom,
+			seed: stageSecrets.seed,
+			manifest
+		});
+		declaredEnv = declared.env;
+		declaredClusters = declared.clusters;
+		if (Object.keys(declaredEnv).length > 0) logger.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
+		if (declared.statements.length > 0) {
+			const serverHostname = getServerHostname(endpoint);
+			for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
+				const statements = declared.statements.filter((statement) => statement.database === databaseName);
+				if (statements.length === 0) continue;
+				const created = await applyDeclaredStatements(api, cluster, serverHostname, statements);
+				logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+			}
+		}
+	}
+	const backupCluster = Object.values(declaredClusters)[0];
+	if (workspace.deploy?.backups && backupCluster) {
+		logger.log("\n💾 Provisioning backup destination...");
+		const { provisionBackupDestination } = await import("./backup-provisioner-DIVCbfee.mjs");
+		const backupState = await provisionBackupDestination({
+			api,
+			projectId: project.projectId,
+			projectName: identity.scope,
+			stage,
+			config: workspace.deploy.backups,
+			existingState: getBackupState(state),
+			logger
+		});
+		setBackupState(state, backupState);
+		if (!backupState.postgresBackupId) {
+			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
+			const backupRetention = workspace.deploy.backups.retention ?? 30;
+			logger.log("   Creating postgres backup schedule...");
+			setPostgresBackupId(state, (await api.createPostgresBackup({
+				schedule: backupSchedule,
+				prefix: `${stage}/postgres`,
+				destinationId: backupState.destinationId,
+				database: backupCluster.databaseName,
+				postgresId: backupCluster.postgresId,
+				enabled: true,
+				keepLatestCount: backupRetention
+			})).backupId);
+			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger.log("   ✓ Using existing postgres backup schedule");
+	}
+	ctx.emit({
+		type: "phase.finished",
+		phase: "provision"
+	});
+	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
+	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
+	const publicUrls = {};
+	const results = [];
+	const appHostnames = /* @__PURE__ */ new Map();
+	const appDomainIds = /* @__PURE__ */ new Map();
+	/** An app is up: say so, and remember where. */
+	const deployed = (appName, result, host) => {
+		const url = `https://${host}`;
+		results.push({
+			...result,
+			success: true,
+			url
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: appName,
+			applicationId: result.applicationId,
+			imageRef: result.imageRef,
+			url
+		});
+	};
+	/** An app failed: say so, and record it in the result. */
+	const failed = (appName, app, error) => {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+		results.push({
+			appName,
+			type: app.type,
+			success: false,
+			error: message
+		});
+		ctx.emit({
+			type: "app.failed",
+			app: appName,
+			error: eventError(error)
+		});
+	};
+	/** An image is pushed: worth keeping even if what follows fails. */
+	const built = async (appName, image, ref) => {
+		setDeployedImage(state, appName, {
+			ref: image.imageRef ?? ref,
+			...image.digest ? { digest: image.digest } : {}
+		});
+		await journal.save();
+		ctx.emit({
+			type: "artifact.built",
+			app: appName,
+			imageRef: image.imageRef ?? ref,
+			...image.digest ? { digest: image.digest } : {}
+		});
+		changes.push({
+			key: `image:${appName}`,
+			resourceType: "image",
+			action: "build",
+			id: image.digest ?? image.imageRef ?? ref
+		});
+	};
+	const frontendUrls = [];
+	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "release"
+	});
+	if (backendApps.length > 0) {
+		logger.log("\n📦 PHASE 1: Deploying backend applications...");
+		for (const appName of backendApps) {
+			ctx.signal?.throwIfAborted();
+			const app = workspace.apps[appName];
+			logger.log(`\n   ⚙️  Deploying ${appName}...`);
+			try {
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId, applied);
+				const appSecrets = encryptedSecrets.get(appName);
+				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
+					encrypted: appSecrets.payload.encrypted,
+					iv: appSecrets.payload.iv
+				} : void 0;
+				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
+				const imageRef$1 = imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$1}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: imageName(identity, appName),
+						appName
+					},
+					credentials,
+					...dockerRun(workspace, app, ctx)
+				});
+				await built(appName, image, imageRef$1);
+				const backendHost = hostOf(workspace, appName, stage);
+				const dependencyUrls = {};
+				if (app.dependencies) {
+					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
+				}
+				const envContext = {
+					app,
+					appName,
+					stage,
+					state,
+					appHostname: backendHost,
+					frontendUrls,
+					userSecrets: stageSecrets ?? void 0,
+					masterKey: appSecrets?.masterKey,
+					dependencyUrls
+				};
+				const sniffedVars = requiredOf(sniffedApps.get(appName));
+				const { valid, missing, resolved } = validateEnvVars([.../* @__PURE__ */ new Set([
+					"PORT",
+					"NODE_ENV",
+					"STAGE",
+					...sniffedVars
+				])], envContext);
+				if (!valid) throw new MissingEnvVars(appName, missing, stage);
+				const withDeclared = {
+					...resolved,
+					...declaredEnv
+				};
+				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
+				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
+				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
+				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
+				logger.log(`      Deploying to Dokploy...`);
+				await api.deployApplication(application.applicationId);
+				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId, applied);
+				appHostnames.set(appName, backendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${backendHost}`;
+				deployed(appName, {
+					appName,
+					type: app.type,
+					applicationId: application.applicationId,
+					imageRef: imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, backendHost);
+				logger.log(`      ✓ ${appName} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(appName, app, error);
+				throw new BackendDeployFailed(appName, error);
+			}
+		}
+	}
+	if (frontendApps.length > 0) {
+		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
+		for (const appName of frontendApps) {
+			ctx.signal?.throwIfAborted();
+			const app = workspace.apps[appName];
+			logger.log(`\n   🌐 Deploying ${appName}...`);
+			try {
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId, applied);
+				const dependencyUrls = {};
+				if (app.dependencies) {
+					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
+				}
+				const frontendHost = hostOf(workspace, appName, stage);
+				const envContext = {
+					app,
+					appName,
+					stage,
+					state,
+					appHostname: frontendHost,
+					frontendUrls: [],
+					userSecrets: stageSecrets ?? void 0,
+					dependencyUrls
+				};
+				const { valid, missing, resolved } = validateEnvVars(requiredOf(sniffedApps.get(appName)), envContext);
+				if (!valid) throw new MissingEnvVars(appName, missing, stage);
+				if (Object.keys(resolved).length > 0) logger.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				const publicPrefix = getPublicEnvPrefix(app.framework);
+				const buildArgs = [];
+				const publicUrlArgNames = [];
+				if (publicPrefix) {
+					for (const [key, value] of Object.entries(resolved)) if (key.startsWith(publicPrefix)) {
+						buildArgs.push(`${key}=${value}`);
+						publicUrlArgNames.push(key);
+					}
+				}
+				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
+				const imageRef$2 = imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$2}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: imageName(identity, appName),
+						appName
+					},
+					buildArgs,
+					publicUrlArgs: publicUrlArgNames,
+					...dockerRun(workspace, app, ctx)
+				});
+				await built(appName, image, imageRef$2);
+				const envVars = [
+					`NODE_ENV=production`,
+					`PORT=${app.port}`,
+					`STAGE=${stage}`
+				];
+				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
+				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
+				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
+				logger.log(`      Deploying to Dokploy...`);
+				await api.deployApplication(application.applicationId);
+				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId, applied);
+				appHostnames.set(appName, frontendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${frontendHost}`;
+				deployed(appName, {
+					appName,
+					type: app.type,
+					applicationId: application.applicationId,
+					imageRef: imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, frontendHost);
+				logger.log(`      ✓ ${appName} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(appName, app, error);
+			}
+		}
+	}
+	logger.log("\n📋 Saving deploy state...");
+	await journal.save();
+	logger.log("   ✓ State saved");
+	ctx.emit({
+		type: "phase.finished",
+		phase: "release"
+	});
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "verify"
+	});
+	const dnsConfig = workspace.deploy.dns;
+	if (dnsConfig && appHostnames.size > 0) {
+		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
+		if (dnsResult?.serverIp && appHostnames.size > 0) {
+			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
+			await journal.save();
+		}
+		if (dnsResult?.success && appHostnames.size > 0) {
+			logger.log("\n🔒 Validating domains for SSL certificates...");
+			for (const [appName, hostname] of appHostnames) try {
+				const result = await api.validateDomain(hostname);
+				if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+				else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
+			} catch (validationError) {
+				const message = validationError instanceof Error ? validationError.message : "Unknown error";
+				logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
+			}
+		}
+	}
+	ctx.emit({
+		type: "phase.finished",
+		phase: "verify"
+	});
+	const successCount = results.filter((r) => r.success).length;
+	const failedCount = results.filter((r) => !r.success).length;
+	logger.log(`\n${"─".repeat(50)}`);
+	logger.log(`\n✅ Workspace deployment complete!`);
+	logger.log(`   Project: ${project.projectId}`);
+	logger.log(`   Successful: ${successCount}`);
+	if (failedCount > 0) logger.log(`   Failed: ${failedCount}`);
+	if (Object.keys(publicUrls).length > 0) {
+		logger.log("\n   📡 Deployed URLs:");
+		for (const [name, url] of Object.entries(publicUrls)) logger.log(`      ${name}: ${url}`);
+	}
+	return {
+		apps: results,
+		projectId: project.projectId,
+		environmentId,
+		successCount,
+		failedCount,
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		dryRun: false,
+		skipped: run.skipped,
+		urls: publicUrls,
+		changes
+	};
+}
+/**
+* An app's Dokploy application, through the journal: by the id recorded for
+* it, else by its name in the stage's environment, else created. Its id goes
+* into `state.applications` too, which the env resolver and `state:show` read.
+*/
+async function ensureApplication(api, journal, appName, dokployAppName, projectId, environmentId, applied) {
+	const recorded = journal.record(`application:${appName}`);
+	if (recorded?.status === "ready" && recorded.id) logger.log(`      Using cached ID: ${recorded.id}`);
+	const { resource, via, staleId } = await journal.ensure({
+		key: `application:${appName}`,
+		type: "application",
+		data: { name: dokployAppName }
+	}, {
+		get: (id) => api.getApplication(id),
+		find: () => api.findApplicationByName(projectId, dokployAppName, environmentId),
+		create: () => api.createApplication(dokployAppName, projectId, environmentId),
+		id: (application) => application.applicationId
+	});
+	if (staleId) logger.log(`      ⚠ Cached ID invalid, will create new`);
+	logger.log(`      ${{
+		recorded: "✓ Application found",
+		resumed: "Resumed application a stopped run created",
+		found: "Found existing application",
+		created: "Created application"
+	}[via]}: ${resource.applicationId}`);
+	applied({
+		key: `application:${appName}`,
+		resourceType: "application",
+		action: via === "created" ? "create" : "reuse",
+		id: resource.applicationId
+	}, via);
+	setApplicationId(journal.state, appName, resource.applicationId);
+	return resource;
+}
+/**
+* The domain `host` routes to an application, through the journal — found on
+* the application before it is created, so a re-run never adds a second.
+*
+* A domain that cannot be created is reported and skipped rather than
+* failing the app: the application is deployed and reachable on Dokploy's
+* own address, and DNS is fixed by hand more easily than a half deploy.
+*/
+async function ensureDomain(api, journal, host, port, applicationId, applied) {
+	try {
+		const { resource, via } = await journal.ensure({
+			key: `domain:${host}`,
+			type: "domain",
+			data: {
+				host,
+				applicationId
+			}
+		}, {
+			find: async () => (await api.getDomainsByApplicationId(applicationId)).find((d) => d.host === host),
+			create: () => api.createDomain({
+				host,
+				port,
+				https: true,
+				certificateType: "letsencrypt",
+				applicationId
+			}),
+			id: (domain) => domain.domainId
+		});
+		logger.log(`      ✓ Domain: https://${host} (${via === "created" ? "created" : "existing"})`);
+		applied({
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: via === "created" ? "create" : "reuse",
+			id: resource.domainId
+		}, via);
+		return resource.domainId;
+	} catch (domainError) {
+		if (domainError instanceof StateVersionConflict || domainError instanceof StateStoreBusy || isAbort(domainError)) throw domainError;
+		const message = domainError instanceof Error ? domainError.message : "Unknown error";
+		logger.log(`      ⚠ Domain creation failed: ${message}`);
+		return;
+	}
+}
+/** Whether `error` is a run being stopped rather than something failing. */
+function isAbort(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+/** Where docker runs for one app: in the app's own directory. */
+function dockerRun(workspace, app, ctx) {
+	return {
+		cwd: resolve(workspace.root, app.path),
+		...ctx.signal ? { signal: ctx.signal } : {},
+		...ctx.stdio ? { stdio: ctx.stdio } : {}
+	};
+}
+/** The Dokploy login, from the run's provider, or `MissingCredential`. */
+async function dokployApi(workspace, ctx) {
+	const configured = workspace.deploy.dokploy?.endpoint;
+	const creds = await ctx.credentials.get({
+		kind: "dokploy",
+		...configured ? { endpoint: configured } : {}
+	}, { signal: ctx.signal });
+	if (!creds) throw new MissingCredential("dokploy", configured);
+	return {
+		api: new DokployApi({
+			baseUrl: creds.endpoint,
+			token: creds.token,
+			...ctx.signal ? { signal: ctx.signal } : {}
+		}),
+		endpoint: creds.endpoint
+	};
+}
+/** Each app's public host, the same way the deploy resolves it. */
+function hostOf(workspace, appName, stage) {
+	const app = workspace.apps[appName];
+	return resolveHost(appName, app, stage, workspace.deploy?.domains, app.type === "web" && isMainFrontendApp(appName, app, workspace.apps));
+}
+/**
+* What a deploy would do, from the same lookups it starts with — and nothing
+* else: no lock, no state written, no secret generated, no Dokploy resource
+* created or changed, no image built or pushed.
+*/
+async function planDeploy(run) {
+	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity } = run;
+	const { ctx } = run;
+	await preflight(run);
+	ctx.emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	ctx.signal?.throwIfAborted();
+	ctx.emit({
+		type: "phase.started",
+		phase: "plan"
+	});
+	logger.log("\n🔎 Dry run: nothing will be created, changed, built or pushed.");
+	const changes = [];
+	const plan = (change, detail) => {
+		changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+		const sign = change.action === "reuse" ? "=" : "+";
+		logger.log(`   ${sign} ${change.action} ${change.key} (${detail})`);
+	};
+	const { api } = await dokployApi(workspace, ctx);
+	const state = (await run.store.read(stage))?.state;
+	const project = await findProject(api, identity, state?.projectId);
+	if (project) plan({
+		key: "project",
+		resourceType: "project",
+		action: "reuse",
+		id: project.projectId
+	}, project.needsClaim ? `${project.name}, would be claimed for ${identity.key}` : project.name);
+	else plan({
+		key: "project",
+		resourceType: "project",
+		action: "create"
+	}, projectName(identity));
+	const environment = project?.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
+	plan(environment ? {
+		key: "environment",
+		resourceType: "environment",
+		action: "reuse",
+		id: environment.environmentId
+	} : {
+		key: "environment",
+		resourceType: "environment",
+		action: "create"
+	}, stage);
+	let registryPlanned;
+	const registry = await resolveRegistry(api, {
+		stage,
+		registry: workspace.deploy.dokploy?.registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state?.registryId,
+		log: (message) => logger.log(message),
+		create: async (url) => {
+			registryPlanned = {
+				key: "registry",
+				resourceType: "registry",
+				action: "create"
+			};
+			return {
+				registryId: "",
+				registryName: url
+			};
+		}
+	});
+	plan(registryPlanned ?? {
+		key: "registry",
+		resourceType: "registry",
+		action: "reuse",
+		id: registry.registryId
+	}, registry.registryName);
+	for (const [id, declaration] of Object.entries(manifest)) plan({
+		key: `construct:${id}`,
+		resourceType: declaration.kind,
+		action: "ensure"
+	}, declaration.kind);
+	const apps = [];
+	const urls = {};
+	for (const appName of appsToDeployNames) {
+		const app = workspace.apps[appName];
+		if (app.type === "mobile") continue;
+		const dokployAppName = applicationName(identity, appName);
+		const recordedId = state?.applications?.[appName];
+		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
+		plan(existing ? {
+			key: `application:${appName}`,
+			resourceType: "application",
+			action: "reuse",
+			id: existing.applicationId
+		} : {
+			key: `application:${appName}`,
+			resourceType: "application",
+			action: "create"
+		}, dokployAppName);
+		const ref = imageRef(identity, appName, workspace.deploy.dokploy?.registry, imageTag);
+		plan({
+			key: `image:${appName}`,
+			resourceType: "image",
+			action: "build"
+		}, ref);
+		const host = hostOf(workspace, appName, stage);
+		const domain = existing ? (await api.getDomainsByApplicationId(existing.applicationId)).find((d) => d.host === host) : void 0;
+		plan(domain ? {
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: "reuse",
+			id: domain.domainId
+		} : {
+			key: `domain:${host}`,
+			resourceType: "domain",
+			action: "create"
+		}, `https://${host}`);
+		urls[appName] = `https://${host}`;
+		apps.push({
+			appName,
+			type: app.type,
+			success: true,
+			imageRef: ref,
+			url: urls[appName],
+			...existing ? { applicationId: existing.applicationId } : {}
+		});
+	}
+	const creates = changes.filter((c) => c.action !== "reuse").length;
+	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
+	ctx.emit({
+		type: "phase.finished",
+		phase: "plan"
+	});
+	return {
+		apps,
+		projectId: project?.projectId ?? "",
+		environmentId: environment?.environmentId ?? "",
+		successCount: apps.length,
+		failedCount: 0,
+		stage,
+		identity: identity.key,
+		tag: imageTag,
+		dryRun: true,
+		skipped: run.skipped,
+		urls,
+		changes
+	};
+}
+/** Why a mobile app is left out of a Dokploy deploy. */
+const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
+//#endregion
+//#region src/deploy/deploy.ts
+/**
+* `deploy()`: a deploy as a library call.
+*
+* `gkm deploy` could only be driven from an interactive terminal: it prompted
+* for what it lacked and exited the process on failure, worked out of
+* `process.cwd()`, and reported progress by printing. Here the caller says
+* where the project is, hands over the credentials and a signal, and gets back
+* a run — events to iterate while it goes, and a structured result at the end.
+* Nothing below this asks a person anything or ends the process; `gkm deploy`
+* is a thin wrapper that does both.
+*/
+/**
+* Every event a run emits, kept so that each iteration — however late it
+* starts — sees the run from its first event to its last.
+*/
+var EventLog = class {
+	events = [];
+	closed = false;
+	waiting = [];
+	push(event) {
+		this.events.push(event);
+		this.wake();
+	}
+	close() {
+		this.closed = true;
+		this.wake();
+	}
+	wake() {
+		const waiting = this.waiting;
+		this.waiting = [];
+		for (const resume of waiting) resume();
+	}
+	async *iterate() {
+		let next = 0;
+		while (true) if (next < this.events.length) yield this.events[next++];
+		else if (this.closed) return;
+		else await new Promise((resume) => this.waiting.push(resume));
+	}
+};
+/** `childOutput` as `spawn` reads it, where it is not the default. */
+const CHILD_STDIO = {
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+function forward(logger, level, message) {
+	if (!logger) return;
+	if (level === "info") logger.info(message);
+	else if (level === "error" && logger.error) logger.error(message);
+	else logger.warn(message);
+}
+/**
+* Deploy a project's stage.
+*
+* ```ts
+* import { deploy } from '@geekmidas/cli/deploy';
+*
+* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
+* for await (const event of run) {
+*   if (event.type === 'app.deployed') console.log(event.app, event.url);
+* }
+* const result = await run.result;
+* ```
+*
+* The run starts at once; iterating it is optional, and an iteration started
+* late still sees every event from the first.
+*/
+function deploy(input) {
+	const log = new EventLog();
+	const emit = (event) => {
+		log.push(event);
+		if (event.type === "log") forward(input.logger, event.level, event.message);
+	};
+	const ctx = {
+		emit,
+		credentials: input.credentials ?? storedCredentials({ home: input.home ?? gkmHome() }),
+		dryRun: input.dryRun ?? false,
+		home: input.home ?? gkmHome(),
+		...input.signal ? { signal: input.signal } : {},
+		...input.childOutput && input.childOutput !== "inherit" ? { stdio: CHILD_STDIO[input.childOutput] } : {}
+	};
+	const result = withOutput((level, message) => emit({
+		type: "log",
+		level,
+		message
+	}), async () => {
+		try {
+			input.signal?.throwIfAborted();
+			const deployed = await runDeploy(() => load(input), {
+				stage: input.stage,
+				...input.tag ? { tag: input.tag } : {},
+				...input.apps ? { apps: input.apps } : {}
+			}, ctx);
+			emit({
+				type: "deploy.finished",
+				result: deployed
+			});
+			return deployed;
+		} catch (error) {
+			emit({
+				type: "deploy.failed",
+				error: eventError(error)
+			});
+			throw error;
+		} finally {
+			log.close();
+		}
+	});
+	result.catch(() => {});
+	return {
+		result,
+		[Symbol.asyncIterator]: () => log.iterate()
+	};
+}
+/** The workspace at `input.cwd`, refusing a stage it does not deploy. */
+async function load(input) {
+	const { workspace } = await loadWorkspaceConfig(resolve(input.cwd));
+	assertDeployedStage(workspace.stages, input.stage);
+	return workspace;
+}
+//#endregion
+export { NoDeployableApps as a, RegistryAmbiguous as c, ProjectNotOwned as d, MissingCredential as f, MissingEnvVars as i, RegistryNotConfigured as l, storedCredentials as m, BackendDeployFailed as n, UnknownDeployApps as o, chainCredentials as p, DeployProviderUnsupported as r, terminalCredentials as s, deploy as t, RegistryNotFound as u };
+
+//# sourceMappingURL=deploy-D6Q09OkA.mjs.map