@geekmidas/cli 10.0.0-alpha.64 → 10.0.0-alpha.66

package/dist/{deploy-55rJkdKz.cjs → engine-DR6KurWX.cjs}

@@ -1,13 +1,13 @@
-const require_sniffer = require("./sniffer-ByhbEW5A.cjs");
-const require_local = require("./local-C7wnrcYK.cjs");
-const require_discover = require("./discover-DHdECueV.cjs");
+const require_local = require("./local-BdH4XN0E.cjs");
+const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_schemas = require("./schemas-RUlKHu27.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-BwgWJK7h.cjs");
-require("./config.cjs");
-const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-D_2ByRtW.cjs");
-const require_credentials = require("./credentials-B70vmLcm.cjs");
-const require_terminal = require("./terminal-Bdv--jhY.cjs");
+const require_workspace = require("./workspace-ON-bqiJz.cjs");
+const require_state = require("./state-Y6ATakMX.cjs");
+const require_sniffer = require("./sniffer-5xmrkh2a.cjs");
+const require_provider = require("./provider-B3Sv_a74.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
@@ -17,1860 +17,1884 @@ let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let node_dns_promises = require("node:dns/promises");
-//#region src/deploy/fromManifest.ts
+//#region src/deploy/docker.ts
+const logger$3 = require_discover.output;
 /**
-* The Dokploy target, read off the construct manifest.
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
 *
-* The AWS target has done this since `fromManifest` landed: a table keyed by
-* declaration kind, each entry turning one declaration into infrastructure and
-* the env keys it resolves. Dokploy had no such thing — it resolved environment
-* from the *sniffer*, which walks application code for `get('X')` calls, and a
-* construct reads its own key inside `@geekmidas/constructs` where there is
-* nothing to find. So a declared app deployed here got none of the model, and
-* nothing reported the absence: the deploy succeeded and the first request that
-* needed a URL failed at runtime.
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
 *
-* This is the same table, over the REST wrapper instead of over Pulumi.
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
 *
-* **Two phases, and the split is not incidental.** Creating a Postgres and
-* creating a role inside it are different kinds of act: the first is an API
-* call, the second needs a connection to a database that does not exist yet
-* when the call is made. So provisioners *accumulate* DDL rather than running
-* it, and it is applied once against a cluster that is up — which is exactly
-* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
 *
-* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
-* the same generators the local target and the AWS target use. Dokploy used to
-* write its own `DO $$` block, which meant three targets applying three
-* different definitions of "the role split" and no way to notice they had
-* drifted.
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
+	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
+	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
+	await (0, node_fs_promises.chmod)(path, 384);
+	return {
+		path,
+		cleanup: () => (0, node_fs_promises.rm)(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
+	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$3.log("   Generating Dockerfile...");
+	await require_state.dockerCommand({
+		slim: true,
+		cwd
+	});
+	const dockerfilePath = dockerfile;
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await require_local.run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs,
+			credentialsFile: secret?.path
+		}), {
+			cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new require_state.DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await require_local.run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new require_state.DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
 *
-* Entries are deliberately small and free of I/O ordering: each takes what it
-* needs and returns what it resolved. That is what would let a Pulumi dynamic
-* provider wrap one later without the table itself changing — see §6b.
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await require_local.runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
 */
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = require_state.validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: (0, node_path.join)(cwd, require_state.dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$3.log("\n✅ Docker deployment ready!");
+	logger$3.log(`\n📋 Deployment details:`);
+	logger$3.log(`   Image: ${imageRef}`);
+	logger$3.log(`   Stage: ${stage}`);
+	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
+//#region src/deploy/ownership.ts
 /**
-* The internal hostname a Dokploy Postgres answers on.
+* Which Dokploy project a deploy is allowed to deploy into.
 *
-* Its own service name on the Docker network — not the server's public address.
-* An app reaching its database over the public internet would be a credential
-* crossing a network that did not need to see it.
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
 */
-function clusterHost(postgres) {
-	return postgres.appName;
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof require_sniffer.DokployApiError) return null;
+		throw error;
+	}
 }
 /**
-* What a resource is called in the provider.
+* The project this identity owns, if there is one — read only, so a dry run
+* asks the same question a deploy does:
 *
-* `cloudName` and nothing else — the same scoped kebab rule the AWS target
-* uses, so a name reads identically on both: `production-shop-orders`.
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project.
+* 2. One with this name *and* this identity's marker.
 *
-* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
-* is one flat list where an application and its database would collide. It is
-* not: `project.one` returns typed collections — `applications`, `postgres`,
-* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
-* the shape of the response and an application and a Postgres of the same name
-* are different objects with different ids. The suffix was answering a question
-* nobody had asked.
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
 */
-function serviceName(scope, id) {
-	return (0, _geekmidas_manifest.cloudName)(scope, id);
-}
-const PROVISIONERS = {
-	/**
-	* A Postgres service, plus the roles that reach it.
-	*
-	* The service is `findOrCreate`, because a deploy that recreated the
-	* database would be a deploy that lost the data. The roles are deferred:
-	* they need a connection to a cluster this call has only just asked for.
-	*/
-	database: async (declaration, context) => {
-		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
-		const name = require_sniffer.resourceName(declaration.id, declaration.kind, context.stage);
-		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
-			stage: context.stage,
-			app: context.scope ?? context.project
-		}, declaration.id), context.projectId, context.environmentId, {
-			databaseName: name,
-			databasePassword: derivedPassword(context, `${name}:master`)
-		});
-		const host = clusterHost(postgres);
-		context.clusters[postgres.databaseName] = postgres;
-		const schema = declaration.schema ?? "app";
-		const runtime = name;
-		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
-		const reads = readsFrom(context.manifest, declaration.id);
-		context.deferred.push(...statementsFor({
-			id: declaration.id,
-			database: postgres.databaseName,
-			ownsDatabase: true,
-			runtime,
-			owner,
-			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
-			schema,
-			context
-		}));
-		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
-		} };
-	},
-	/**
-	* A schema in the parent's database, with its own role and its own URL — so
-	* the parent's role holds no grant on these tables at all.
-	*/
-	"database-schema": async (declaration, context) => {
-		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
-		const parent = context.provisioned[declaration.of];
-		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const runtime = require_sniffer.resourceName(declaration.id, declaration.kind, context.stage);
-		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
-		const reads = readsFrom(context.manifest, declaration.id);
-		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
-		context.deferred.push(...statementsFor({
-			id: declaration.id,
-			database: parentUrl.pathname.slice(1),
-			runtime,
-			owner,
-			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
-			schema: declaration.schema,
-			context
-		}));
-		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
-		} };
-	},
-	/**
-	* A read-only endpoint on the same cluster.
-	*
-	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
-	* resolves to the writer's address — and that is safe rather than a
-	* loophole, because read-only is enforced by the reader role's grants and
-	* not by which host the URL names. The role itself was created with its
-	* parent.
-	*/
-	"database-reader": async (declaration, context) => {
-		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
-		const parent = context.provisioned[declaration.of];
-		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
-		const reader = (0, _geekmidas_db_pg_roles.readerRole)(parentUrl.username);
-		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
-	},
-	/**
-	* A cache, wherever the project said it lives.
-	*
-	* `db` is a table in a database the manifest already declares, so it
-	* provisions no service and costs nothing to run — the same relationship
-	* pg-boss has. The table's DDL is deferred with the roles, and the table
-	* name travels in the URL because two caches in one database resolve the
-	* same connection string.
-	*/
-	cache: async (declaration, context) => {
-		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
-		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
-		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
-		const parent = context.provisioned[parentId];
-		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
-		const parentUrl = parent.provides[(0, _geekmidas_manifest.provideKey)(parentId, "url")];
-		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
-		const table = declaration.table ?? (0, _geekmidas_manifest.cacheTable)(declaration.id);
-		const schema = schemaOf(context.manifest, parentId);
-		const qualified = schema ? `${schema}.${table}` : table;
-		context.deferred.push(...(0, _geekmidas_cache_postgres.cacheTableStatements)({ table: qualified }).map((statement) => ({
-			id: declaration.id,
-			database: new URL(parentUrl).pathname.slice(1),
-			describe: statement.describe,
-			sql: statement.sql,
-			...statement.exists ? { exists: statement.exists } : {}
-		})), {
-			id: declaration.id,
-			database: new URL(parentUrl).pathname.slice(1),
-			describe: `${qualified} is owned by its schema's owner`,
-			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted((0, _geekmidas_db_pg_roles.ownerRole)(new URL(parentUrl).username))}`
-		}, {
-			id: declaration.id,
-			database: new URL(parentUrl).pathname.slice(1),
-			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
-			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
-		});
-		const url = new URL(parentUrl);
-		url.searchParams.set("table", table);
-		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url.toString() } };
-	},
-	/**
-	* A bucket, as a MinIO stack on the box.
-	*
-	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* object storage, so this is the one kind whose infrastructure this target
-	* *writes* rather than configures — a compose file with one service in it.
-	*
-	* The service is named `cloudName(...)` like everything else, which is not
-	* cosmetic here: containers on `dokploy-network` resolve each other by
-	* service name, so the name is the address. Calling it `minio` would work
-	* for exactly one project on the box and then collide.
-	*
-	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
-	* reads them from an execution role, so a URL that embedded a key would be
-	* one more thing to rotate and leak. There is no role here, so the same
-	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
-	* locally.
-	*/
-	objects: async (declaration, context) => {
-		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
-		const backend = context.storage ?? "minio";
-		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
-		const service = serviceName({
-			stage: context.stage,
-			app: context.scope ?? context.project
-		}, declaration.id);
-		const bucket = require_sniffer.resourceName(declaration.id, declaration.kind, context.stage);
-		const user = `${bucket}-root`;
-		const password = derivedPassword(context, `objects:${declaration.id}`);
-		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
-			service,
-			bucket,
-			user,
-			password
-		}));
-		await context.api.deployCompose(compose.composeId);
-		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: s3Url(service, bucket),
-			AWS_ACCESS_KEY_ID: user,
-			AWS_SECRET_ACCESS_KEY: password,
-			AWS_REGION: MINIO_REGION
-		} };
-	},
-	/**
-	* The address a bucket's objects are served on.
-	*
-	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
-	* behind the first would terminate TLS twice — which is why the local
-	* target's Caddy has no equivalent here. What this resolves is the address,
-	* and the `open` prefixes are applied to the bucket rather than to an edge,
-	* so a policy is what makes them public wherever the bucket lives.
-	*
-	* Until a Traefik rule exists it answers on MinIO directly, path-style,
-	* which is honest about the shape it has today: the bucket is in the path
-	* rather than fronted by a host of its own.
-	*/
-	"file-server": async (declaration, context) => {
-		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
-		const parentUrl = context.provisioned[declaration.of]?.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")];
-		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
-		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
-		const bucket = new URL(parentUrl).hostname;
-		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
-		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: `${endpoint}/${bucket}` } };
-	},
-	/**
-	* A topic, and below it a queue — the same broker either way.
-	*
-	* Under pg-boss there is nothing to create in Dokploy: the broker is a
-	* schema tenant of the database the app already declared, exactly as it is
-	* locally, so what this resolves is an address rather than a service. Which
-	* is the point of putting the backend in config — the same handlers drain
-	* pg-boss here and SQS on AWS because the string they were handed said so.
-	*
-	* The tenant gets its own role rather than the cluster master, for the
-	* reason every other tenant does: pg-boss creates and owns its tables, and
-	* a broker that could also read the application's is a broker with a grant
-	* nothing asked for.
-	*/
-	topic: async (declaration, context) => {
-		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
-		return broker(declaration.id, context);
-	},
-	queue: async (declaration, context) => {
-		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
-		return broker(declaration.id, context);
-	},
-	/**
-	* A signing key, generated once and remembered in the stage's store.
-	*
-	* Random, never derived: a key computed from the project and stage names
-	* signs sessions anyone reading the repo could forge. The deploy generates
-	* it before provisioning (`withGeneratedSecrets`) and every later deploy
-	* reads the same one, so live sessions survive a redeploy. Nothing is
-	* created in Dokploy: a secret has no address.
-	*/
-	secret: async (declaration, context) => {
-		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
-		const key = declaration.provides?.[0];
-		if (!key) return { provides: {} };
-		return { provides: { [key]: supplied(declaration.id, key, context) } };
-	},
-	/**
-	* The keyring the stage keeps in its secrets.
-	*
-	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
-	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
-	* written becomes unreadable. Nothing is created in Dokploy: the process
-	* holds the keyring.
-	*/
-	encryption: async (declaration, context) => {
-		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
-		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
-		return { provides: { [key]: supplied(declaration.id, key, context) } };
-	},
-	/**
-	* A third party's credentials, as the stage was given them.
-	*
-	* Nothing is created and nothing derived: the value was issued by somebody
-	* else. A stage that was never given one fails the deploy here, naming the
-	* command that sets it — not the first request that needs it.
-	*/
-	credential: async (declaration, context) => {
-		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
-		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
-		return { provides: { [key]: supplied(declaration.id, key, context) } };
-	},
-	/**
-	* An API somebody else runs: the URL this stage calls it at, and the
-	* credentials it was issued for this stage.
-	*/
-	"external-api": async (declaration, context) => {
-		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
-		const credentials = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
-		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: (0, _geekmidas_manifest.externalApiUrl)(declaration, context.stage),
-			[credentials]: supplied(declaration.id, credentials, context)
-		} };
-	},
-	/**
-	* A surface, at the address whatever created its domain assigned.
-	*
-	* Nothing is provisioned here: the application and its domain are the
-	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
-	* Encrypt certificate. What this adds is the *derivation* — who may call it,
-	* and where a cookie it sets is readable — from the graph rather than from a
-	* hand-maintained list.
-	*/
-	"rest-api": async (declaration, context) => {
-		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
-		const url = context.addresses?.[declaration.id];
-		if (!url) throw new SurfaceHasNoAddress(declaration.id);
-		const origins = [...new Set((0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
-		const domain = (0, _geekmidas_manifest.cookieDomain)([url, ...origins]);
-		const schemes = (0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).flatMap((caller) => {
-			const app = context.manifest[caller];
-			return app?.kind === "mobile-app" ? (0, _geekmidas_manifest.mobileOrigins)((0, _geekmidas_manifest.schemeBase)(context.project, app.scheme)) : [];
-		});
-		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url,
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
-			...domain ? { [(0, _geekmidas_manifest.provideKey)(declaration.id, "cookieDomain")]: domain } : {}
-		} };
-	}
-};
-/** The provisioner for a kind, or nothing where this target has none yet. */
-function provisionerFor(kind) {
-	return PROVISIONERS[kind];
-}
-/**
-* The role DDL for one database or tenant, from the shared generator.
-*
-* The same statements the local target applies and the same ones the AWS
-* bootstrap runs. Dokploy used to write its own, which is how three targets
-* came to hold three definitions of the same split.
-*/
-function statementsFor(options) {
-	const { id, database, runtime, owner, reader, schema, context } = options;
-	return (0, _geekmidas_db_pg_roles.roleStatements)({
-		runtime,
-		owner,
-		...reader ? { reader } : {},
-		schema,
-		...options.ownsDatabase ? { database } : {},
-		passwords: {
-			runtime: derivedPassword(context, runtime),
-			owner: derivedPassword(context, owner),
-			...reader ? { reader: derivedPassword(context, reader) } : {}
-		}
-	}).map((statement) => ({
-		...statement,
-		id,
-		database
-	}));
-}
-/**
-* The connection string a declared queue or topic publishes on.
-*
-* One broker for the whole project, which is what the local target does and
-* what the runtime expects: the generated pollers open a single connection and
-* subscribe each worker by name on it. So every carrier resolves to the same
-* address, and the DDL that backs it is pushed once however many are declared.
-*
-* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
-* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
-* the §4.3 question, and composing a plausible URL for either would fail at the
-* first publish instead of here.
-*/
-function broker(id, context) {
-	const backend = context.events ?? "pgboss";
-	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
-	const parentId = soleDatabase(context);
-	if (!parentId) throw new BrokerNeedsADatabase(id);
-	const parentUrl = context.provisioned[parentId]?.provides[(0, _geekmidas_manifest.provideKey)(parentId, "url")];
-	if (!parentUrl) throw new UnresolvedParent(id, parentId);
-	const url = new URL(parentUrl);
-	const database = url.pathname.slice(1);
-	const runtime = `${database}_${PGBOSS_SCHEMA}`;
-	const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
-	if (!context.provisioned[BROKER_ID]) {
-		context.deferred.push(...statementsFor({
-			id: BROKER_ID,
-			database,
-			runtime,
-			owner,
-			schema: PGBOSS_SCHEMA,
-			context
-		}));
-		context.provisioned[BROKER_ID] = { provides: {} };
-	}
-	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
-	return { provides: { [(0, _geekmidas_manifest.provideKey)(id, "publisherConnectionString")]: connection } };
-}
-/** The schema pg-boss creates its tables in, here as locally. */
-const PGBOSS_SCHEMA = "pgboss";
-/**
-* The id the broker's DDL is pushed under.
-*
-* Not a construct — no declaration names it — but the deferred statements need
-* an id, and every carrier in the project shares this one.
-*/
-const BROKER_ID = "PgBoss";
-/**
-* A pg-boss address: a Postgres URL under a scheme that picks the transport.
-*
-* The protocol is what a producer branches on, so it never branches — the same
-* `.publish()` reaches pg-boss here and SQS on AWS.
-*/
-function pgbossUrl(role, password, host, database) {
-	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
-}
-/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
-const MINIO_REGION = "us-east-1";
-/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
-function s3Url(service, bucket) {
-	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
-}
-/**
-* A one-service compose file for a bucket.
-*
-* `dokploy-network` is external and already exists — it is what every Dokploy
-* service is attached to, and joining it is what makes the app able to resolve
-* this one by name. The bucket itself is created by MinIO's entrypoint rather
-* than by a second call, so there is nothing to reconcile afterwards.
-*/
-function minioCompose(options) {
-	const { service, bucket, user, password } = options;
-	return [
-		"services:",
-		`  ${service}:`,
-		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
-		`    command: server /data --console-address ":9001"`,
-		"    environment:",
-		`      MINIO_ROOT_USER: ${user}`,
-		`      MINIO_ROOT_PASSWORD: ${password}`,
-		"    volumes:",
-		`      - ${service}-data:/data`,
-		"    networks:",
-		"      - dokploy-network",
-		"    healthcheck:",
-		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
-		"      interval: 10s",
-		"      retries: 5",
-		`  ${service}-bucket:`,
-		"    image: minio/mc:latest",
-		"    depends_on:",
-		`      ${service}:`,
-		"        condition: service_healthy",
-		"    entrypoint: >",
-		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
-		`      mc mb --ignore-existing s3/${bucket}"`,
-		"    networks:",
-		"      - dokploy-network",
-		"volumes:",
-		`  ${service}-data:`,
-		"networks:",
-		"  dokploy-network:",
-		"    external: true",
-		""
-	].join("\n");
-}
-/** Whether anything reads through a reader on this construct. */
-function readsFrom(manifest, id) {
-	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
-}
-/** The schema a database or tenant pins on its roles. */
-function schemaOf(manifest, id) {
-	const declaration = manifest[id];
-	if (declaration?.kind === "database") return declaration.schema ?? "app";
-	if (declaration?.kind === "database-schema") return declaration.schema;
-}
-/**
-* The one declared database, where `cache: 'db'` has to pick.
-*
-* Unambiguous with one and arbitrary with two, so two is an error rather than a
-* coin toss — a cache landing in a database nobody chose surfaces as entries
-* that are never found, long after the deploy reported success.
-*/
-function soleDatabase(context) {
-	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
-	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
-	return databases[0];
+async function findProject(api, identity, stateProjectId) {
+	const name = require_state.projectName(identity);
+	const marker = require_state.ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = require_state.markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				description: known.description ?? null,
+				environments: known.environments ?? [],
+				via: "state",
+				needsClaim: !claimed
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && require_state.isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			description: owned.description ?? null,
+			environments: details.environments ?? [],
+			via: "marker",
+			needsClaim: false
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, require_state.markerOf(clash.description));
+	return null;
 }
 /**
-* A password derived from the stage's seed, the project, the stage and the role.
-*
-* Derived rather than stored per role so a redeploy hands the running
-* application the password it already has, and two projects never share one.
-* The seed is what makes it secret: random, generated once and kept in the
-* stage's store. Without it the inputs are all in the repo, and so was every
-* production password.
+* The project this deploy deploys into: the one {@link findProject} finds —
+* claimed with this identity's marker if it carries none yet, so the next
+* deploy without state still finds it — or a new one, marked.
 */
-function derivedPassword(context, role) {
-	return (0, node_crypto.createHash)("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
-}
-/** A connection string for a role on a cluster. */
-function postgresUrl(role, password, host, database) {
-	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
-}
-/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
-function quoted(name) {
-	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const marker = require_state.ownershipMarker(identity);
+	const found = await findProject(api, identity, stateProjectId);
+	if (found) {
+		if (found.needsClaim) {
+			await api.updateProject(found.projectId, {
+				name: found.name,
+				description: withMarker(found.description, marker)
+			});
+			log(`   Claimed project ${found.name} for ${identity.key}`);
+		}
+		return {
+			projectId: found.projectId,
+			name: found.name,
+			environments: found.environments,
+			via: found.via
+		};
+	}
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(require_state.projectName(identity), withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
 }
-/** A provisioner was handed a declaration of the wrong kind. */
+//#endregion
+//#region src/deploy/registry.ts
 /**
-* A value only the stage's own secrets can hold.
+* Which Dokploy registry a stage's images are pulled through.
 *
-* @throws {MissingSuppliedSecret} when the stage was never given it.
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
 */
-function supplied(id, key, context) {
-	const value = context.supplied?.[key];
-	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
-	return value;
-}
-/** A construct needs a value the stage was never given. */
-var MissingSuppliedSecret = class extends Error {
-	id;
-	key;
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
 	stage;
-	constructor(id, key, stage) {
-		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
-		this.id = id;
-		this.key = key;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
 		this.stage = stage;
-		this.name = "MissingSuppliedSecret";
-	}
-};
-var WrongKind = class extends Error {
-	kind;
-	constructor(kind) {
-		super(`No Dokploy provisioner handles '${kind}'`);
-		this.kind = kind;
-		this.name = "WrongKind";
+		this.name = "RegistryNotConfigured";
 	}
 };
-/** A derived construct whose parent has not been provisioned. */
-var UnresolvedParent = class extends Error {
-	id;
-	parent;
-	constructor(id, parent) {
-		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
-		this.id = id;
-		this.parent = parent;
-		this.name = "UnresolvedParent";
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
 	}
 };
-/** A cache with nowhere to live. */
-var CacheNeedsAHome = class extends Error {
-	id;
-	backend;
-	constructor(id, backend) {
-		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
-		this.id = id;
-		this.backend = backend;
-		this.name = "CacheNeedsAHome";
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
 	}
 };
-/** A `'db'` cache (a server target's default) with more than one database. */
-var CacheIsAmbiguous = class extends Error {
-	databases;
-	constructor(databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
-		this.databases = databases;
-		this.name = "CacheIsAmbiguous";
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof require_sniffer.DokployApiError) return null;
+		throw error;
 	}
-};
-/** A surface reached provisioning before its domain existed. */
-var SurfaceHasNoAddress = class extends Error {
-	id;
-	constructor(id) {
-		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
-		this.id = id;
-		this.name = "SurfaceHasNoAddress";
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
 	}
-};
-/** A queue or topic on a backend this target has no primitive for. */
-var UnprovisionableCarrier = class extends Error {
-	id;
-	backend;
-	constructor(id, backend) {
-		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
-		this.id = id;
-		this.backend = backend;
-		this.name = "UnprovisionableCarrier";
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
 	}
-};
-/** A pg-boss carrier in an app that declares no database to host it. */
-var BrokerNeedsADatabase = class extends Error {
-	id;
-	constructor(id) {
-		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
-		this.id = id;
-		this.name = "BrokerNeedsADatabase";
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
+//#region src/deploy/secrets.ts
+/**
+* Filter secrets to only include the env vars that an app requires.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Filtered secrets with found/missing tracking
+*/
+function filterSecretsForApp(stageSecrets, sniffedEnv) {
+	const allSecrets = require_state.toEmbeddableSecrets(stageSecrets);
+	const filtered = {};
+	const found = [];
+	const missing = [];
+	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
+		filtered[key] = allSecrets[key];
+		found.push(key);
+	} else missing.push(key);
+	return {
+		appName: sniffedEnv.appName,
+		secrets: filtered,
+		found: found.sort(),
+		missing: missing.sort()
+	};
+}
+/**
+* Encrypt filtered secrets for an app.
+* Generates an ephemeral master key that should be injected into Dokploy.
+*
+* @param filteredSecrets - The filtered secrets for the app
+* @returns Encrypted payload with master key
+*/
+function encryptSecretsForApp(filteredSecrets) {
+	const payload = require_sniffer.encryptSecrets(filteredSecrets.secrets);
+	return {
+		appName: filteredSecrets.appName,
+		payload,
+		masterKey: payload.masterKey,
+		secretCount: Object.keys(filteredSecrets.secrets).length,
+		missingSecrets: filteredSecrets.missing
+	};
+}
+/**
+* Filter and encrypt secrets for an app in one step.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Encrypted secrets with master key
+*/
+function prepareSecretsForApp(stageSecrets, sniffedEnv) {
+	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+}
+/**
+* Prepare secrets for multiple apps.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedApps - Map of app name to sniffed environment
+* @returns Map of app name to encrypted secrets
+*/
+function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
+		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
+		results.set(appName, encrypted);
 	}
-};
-/** A bucket on a backend this target has no primitive for. */
-var UnprovisionableBucket = class extends Error {
-	id;
-	backend;
-	constructor(id, backend) {
-		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
-		this.id = id;
-		this.backend = backend;
-		this.name = "UnprovisionableBucket";
+	return results;
+}
+/**
+* Generate a report on secrets preparation.
+*/
+function generateSecretsReport(encryptedApps, sniffedApps) {
+	const appsWithSecrets = [];
+	const appsWithoutSecrets = [];
+	const appsWithMissingSecrets = [];
+	for (const [appName, sniffedEnv] of sniffedApps) {
+		if (sniffedEnv.requiredEnvVars.length === 0) {
+			appsWithoutSecrets.push(appName);
+			continue;
+		}
+		const encrypted = encryptedApps.get(appName);
+		if (encrypted) {
+			appsWithSecrets.push(appName);
+			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
+				appName,
+				missing: encrypted.missingSecrets
+			});
+		}
 	}
-};
+	return {
+		totalApps: sniffedApps.size,
+		appsWithSecrets: appsWithSecrets.sort(),
+		appsWithoutSecrets: appsWithoutSecrets.sort(),
+		appsWithMissingSecrets
+	};
+}
 //#endregion
-//#region src/deploy/declared.ts
+//#region src/target/dokploy/fromManifest.ts
 /**
-* The declared half of a Dokploy deploy.
+* The Dokploy target, read off the construct manifest.
 *
-* `fromManifest.ts` decides what each construct resolves to; this runs it —
-* discovers the manifest, walks it parents-first, and applies the DDL the
-* provisioners deferred.
+* The AWS target has done this since `fromManifest` landed: a table keyed by
+* declaration kind, each entry turning one declaration into infrastructure and
+* the env keys it resolves. Dokploy had no such thing — it resolved environment
+* from the *sniffer*, which walks application code for `get('X')` calls, and a
+* construct reads its own key inside `@geekmidas/constructs` where there is
+* nothing to find. So a declared app deployed here got none of the model, and
+* nothing reported the absence: the deploy succeeded and the first request that
+* needed a URL failed at runtime.
 *
-* It is deliberately separate from the engine in `index.ts`. That file deploys
-* *applications*: images, registries, domains, the things a project has whether
-* or not it declares anything. This is the part that exists because the app
-* declared it, and keeping the two apart is what lets a project adopt the model
-* without rewriting its deploy — and lets this one be tested without one.
+* This is the same table, over the REST wrapper instead of over Pulumi.
+*
+* **Two phases, and the split is not incidental.** Creating a Postgres and
+* creating a role inside it are different kinds of act: the first is an API
+* call, the second needs a connection to a database that does not exist yet
+* when the call is made. So provisioners *accumulate* DDL rather than running
+* it, and it is applied once against a cluster that is up — which is exactly
+* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+*
+* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
+* the same generators the local target and the AWS target use. Dokploy used to
+* write its own `DO $$` block, which meant three targets applying three
+* different definitions of "the role split" and no way to notice they had
+* drifted.
+*
+* Entries are deliberately small and free of I/O ordering: each takes what it
+* needs and returns what it resolved. That is what would let a Pulumi dynamic
+* provider wrap one later without the table itself changing — see §6b.
 */
 /**
-* Provision everything the workspace declares, and return what it resolved.
+* The internal hostname a Dokploy Postgres answers on.
+*
+* Its own service name on the Docker network — not the server's public address.
+* An app reaching its database over the public internet would be a credential
+* crossing a network that did not need to see it.
 */
-async function provisionDeclared(options) {
-	const { workspace } = options;
-	const empty = {
-		env: {},
-		statements: [],
-		provisioned: {},
-		clusters: {}
-	};
-	const manifest = options.manifest ?? await require_discover.discover({
-		patterns: require_sniffer.constructGlobs(workspace),
-		cwd: workspace.root
-	});
-	if (Object.keys(manifest).length === 0) return empty;
-	const context = {
-		manifest,
-		provisioned: {},
-		api: options.api,
-		projectId: options.projectId,
-		environmentId: options.environmentId,
-		stage: options.stage,
-		project: workspace.name,
-		scope: options.scope ?? workspace.name,
-		cache: require_sniffer.cacheBackendFor(require_sniffer.providerOf(workspace)),
-		events: require_sniffer.eventsBackendFor(require_sniffer.providerOf(workspace)),
-		storage: require_sniffer.storageBackendFor(require_sniffer.providerOf(workspace)),
-		addresses: surfaceAddresses(manifest, options.appUrls),
-		seed: options.seed,
-		...options.supplied ? { supplied: options.supplied } : {},
-		deferred: [],
-		clusters: {}
-	};
-	const env = {};
-	for (const id of carriersLast((0, _geekmidas_manifest.provisionOrder)(manifest), manifest)) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const provisioner = provisionerFor(declaration.kind);
-		if (!provisioner) continue;
-		const result = await provisioner(declaration, context);
-		context.provisioned[id] = result;
-		Object.assign(env, result.provides);
-	}
-	return {
-		env,
-		statements: context.deferred.map((statement) => ({
-			id: statement.id,
+function clusterHost(postgres) {
+	return postgres.appName;
+}
+/**
+* What a resource is called in the provider.
+*
+* `cloudName` and nothing else — the same scoped kebab rule the AWS target
+* uses, so a name reads identically on both: `production-shop-orders`.
+*
+* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
+* is one flat list where an application and its database would collide. It is
+* not: `project.one` returns typed collections — `applications`, `postgres`,
+* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
+* the shape of the response and an application and a Postgres of the same name
+* are different objects with different ids. The suffix was answering a question
+* nobody had asked.
+*/
+function serviceName(scope, id) {
+	return (0, _geekmidas_manifest.cloudName)(scope, id);
+}
+const PROVISIONERS = {
+	/**
+	* A Postgres service, plus the roles that reach it.
+	*
+	* The service is `findOrCreate`, because a deploy that recreated the
+	* database would be a deploy that lost the data. The roles are deferred:
+	* they need a connection to a cluster this call has only just asked for.
+	*/
+	database: async (declaration, context) => {
+		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
+		const name = require_state.resourceName(declaration.id, declaration.kind, context.stage);
+		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id), context.projectId, context.environmentId, {
+			databaseName: name,
+			databasePassword: derivedPassword(context, `${name}:master`)
+		});
+		const host = clusterHost(postgres);
+		context.clusters[postgres.databaseName] = postgres;
+		const schema = declaration.schema ?? "app";
+		const runtime = name;
+		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: postgres.databaseName,
+			ownsDatabase: true,
+			runtime,
+			owner,
+			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
+			schema,
+			context
+		}));
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
+		} };
+	},
+	/**
+	* A schema in the parent's database, with its own role and its own URL — so
+	* the parent's role holds no grant on these tables at all.
+	*/
+	"database-schema": async (declaration, context) => {
+		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const runtime = require_state.resourceName(declaration.id, declaration.kind, context.stage);
+		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: parentUrl.pathname.slice(1),
+			runtime,
+			owner,
+			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
+			schema: declaration.schema,
+			context
+		}));
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
+		} };
+	},
+	/**
+	* A read-only endpoint on the same cluster.
+	*
+	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
+	* resolves to the writer's address — and that is safe rather than a
+	* loophole, because read-only is enforced by the reader role's grants and
+	* not by which host the URL names. The role itself was created with its
+	* parent.
+	*/
+	"database-reader": async (declaration, context) => {
+		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
+		const reader = (0, _geekmidas_db_pg_roles.readerRole)(parentUrl.username);
+		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
+	},
+	/**
+	* A cache, wherever the project said it lives.
+	*
+	* `db` is a table in a database the manifest already declares, so it
+	* provisions no service and costs nothing to run — the same relationship
+	* pg-boss has. The table's DDL is deferred with the roles, and the table
+	* name travels in the URL because two caches in one database resolve the
+	* same connection string.
+	*/
+	cache: async (declaration, context) => {
+		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
+		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
+		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
+		const parent = context.provisioned[parentId];
+		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
+		const parentUrl = parent.provides[(0, _geekmidas_manifest.provideKey)(parentId, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
+		const table = declaration.table ?? (0, _geekmidas_manifest.cacheTable)(declaration.id);
+		const schema = schemaOf(context.manifest, parentId);
+		const qualified = schema ? `${schema}.${table}` : table;
+		context.deferred.push(...(0, _geekmidas_cache_postgres.cacheTableStatements)({ table: qualified }).map((statement) => ({
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
 			describe: statement.describe,
-			...statement.database ? { database: statement.database } : {},
-			...statement.exists ? { exists: statement.exists } : {},
-			create: statement.sql
-		})),
-		provisioned: context.provisioned,
-		clusters: context.clusters
-	};
-}
-/**
-* Run the deferred DDL against a cluster that is now reachable.
-*
-* The same applier the local target uses: every statement asks whether it is
-* needed first, so a redeploy is free and a half-applied run recovers by being
-* run again.
-*/
-async function applyDeclared(client, statements) {
-	return (await require_sniffer.applyPostgres(client, statements)).filter((entry) => entry.created).length;
-}
-/**
-* The provisioning order, with queues and topics moved to the end.
-*
-* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
-* *derived from* a database, because under SNS it does not live in one. Where
-* it lives is a fact about the backend, which is config — so the dependency is
-* real under pg-boss and absent under SNS, and writing it into the declaration
-* would state it in the one place that cannot know.
-*
-* Here it can. This runs where the backend is known, and the rule needs no
-* branch on it: nothing depends on a carrier. A queue's worker and a topic's
-* subscribers are *bound* to it rather than dependent on it, which is why
-* neither holds a key of its own — so a carrier can always go last, and under
-* pg-boss that is exactly late enough for the database it reads to be there.
-*/
-function carriersLast(ordered, manifest) {
-	const carries = (id) => {
-		const kind = manifest[id]?.kind;
-		return kind === "queue" || kind === "topic";
-	};
-	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
-}
-/**
-* Where each declared surface answers: its own app's address.
-*
-* Every surface is an app of its own, keyed by its id the way the derivation
-* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
-* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
-* address, so a workspace with two APIs pointed both at the same one.
-*/
-function surfaceAddresses(manifest, appUrls) {
-	const addresses = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api") continue;
-		const url = appUrls[require_derive.appKey(id)];
-		if (url) addresses[id] = url;
-	}
-	return addresses;
-}
-//#endregion
-//#region src/deploy/dns/DnsProvider.ts
-/**
-* Check if value is a DnsProvider implementation.
-*/
-function isDnsProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
-}
-/**
-* Create a DNS provider based on configuration.
-*
-* - 'hostinger': HostingerProvider
-* - 'route53': Route53Provider
-* - 'manual': Returns null (user handles DNS)
-* - Custom: Use provided DnsProvider implementation
-*/
-async function createDnsProvider(options) {
-	const { config } = options;
-	if (config.provider === "manual") return null;
-	if (isDnsProvider(config.provider)) return config.provider;
-	const provider = config.provider;
-	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-Bx2lHHvu.cjs"));
-		return new HostingerProvider();
-	}
-	if (provider === "route53") {
-		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-DVILBsvV.cjs"));
-		const route53Config = config;
-		return new Route53Provider({
-			region: route53Config.region,
-			profile: route53Config.profile,
-			hostedZoneId: route53Config.hostedZoneId
+			sql: statement.sql,
+			...statement.exists ? { exists: statement.exists } : {}
+		})), {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${qualified} is owned by its schema's owner`,
+			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted((0, _geekmidas_db_pg_roles.ownerRole)(new URL(parentUrl).username))}`
+		}, {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
+			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
+		});
+		const url = new URL(parentUrl);
+		url.searchParams.set("table", table);
+		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url.toString() } };
+	},
+	/**
+	* A bucket, as a MinIO stack on the box.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* object storage, so this is the one kind whose infrastructure this target
+	* *writes* rather than configures — a compose file with one service in it.
+	*
+	* The service is named `cloudName(...)` like everything else, which is not
+	* cosmetic here: containers on `dokploy-network` resolve each other by
+	* service name, so the name is the address. Calling it `minio` would work
+	* for exactly one project on the box and then collide.
+	*
+	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
+	* reads them from an execution role, so a URL that embedded a key would be
+	* one more thing to rotate and leak. There is no role here, so the same
+	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
+	* locally.
+	*/
+	objects: async (declaration, context) => {
+		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const backend = context.storage ?? "minio";
+		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const bucket = require_state.resourceName(declaration.id, declaration.kind, context.stage);
+		const user = `${bucket}-root`;
+		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
+			service,
+			bucket,
+			user,
+			password
+		}));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: s3Url(service, bucket),
+			AWS_ACCESS_KEY_ID: user,
+			AWS_SECRET_ACCESS_KEY: password,
+			AWS_REGION: MINIO_REGION
+		} };
+	},
+	/**
+	* The address a bucket's objects are served on.
+	*
+	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
+	* behind the first would terminate TLS twice — which is why the local
+	* target's Caddy has no equivalent here. What this resolves is the address,
+	* and the `open` prefixes are applied to the bucket rather than to an edge,
+	* so a policy is what makes them public wherever the bucket lives.
+	*
+	* Until a Traefik rule exists it answers on MinIO directly, path-style,
+	* which is honest about the shape it has today: the bucket is in the path
+	* rather than fronted by a host of its own.
+	*/
+	"file-server": async (declaration, context) => {
+		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const parentUrl = context.provisioned[declaration.of]?.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
+		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
+		const bucket = new URL(parentUrl).hostname;
+		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
+		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* A topic, and below it a queue — the same broker either way.
+	*
+	* Under pg-boss there is nothing to create in Dokploy: the broker is a
+	* schema tenant of the database the app already declared, exactly as it is
+	* locally, so what this resolves is an address rather than a service. Which
+	* is the point of putting the backend in config — the same handlers drain
+	* pg-boss here and SQS on AWS because the string they were handed said so.
+	*
+	* The tenant gets its own role rather than the cluster master, for the
+	* reason every other tenant does: pg-boss creates and owns its tables, and
+	* a broker that could also read the application's is a broker with a grant
+	* nothing asked for.
+	*/
+	topic: async (declaration, context) => {
+		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	queue: async (declaration, context) => {
+		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	/**
+	* A signing key, generated once and remembered in the stage's store.
+	*
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
+	*/
+	secret: async (declaration, context) => {
+		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
+		const key = declaration.provides?.[0];
+		if (!key) return { provides: {} };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = (0, _geekmidas_manifest.provideKey)(declaration.id, "credentials");
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: (0, _geekmidas_manifest.externalApiUrl)(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
+	},
+	/**
+	* A surface, at the address whatever created its domain assigned.
+	*
+	* Nothing is provisioned here: the application and its domain are the
+	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
+	* Encrypt certificate. What this adds is the *derivation* — who may call it,
+	* and where a cookie it sets is readable — from the graph rather than from a
+	* hand-maintained list.
+	*/
+	"rest-api": async (declaration, context) => {
+		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
+		const url = context.addresses?.[declaration.id];
+		if (!url) throw new SurfaceHasNoAddress(declaration.id);
+		const origins = [...new Set((0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
+		const domain = (0, _geekmidas_manifest.cookieDomain)([url, ...origins]);
+		const schemes = (0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? (0, _geekmidas_manifest.mobileOrigins)((0, _geekmidas_manifest.schemeBase)(context.project, app.scheme)) : [];
 		});
+		return { provides: {
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url,
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
+			...domain ? { [(0, _geekmidas_manifest.provideKey)(declaration.id, "cookieDomain")]: domain } : {}
+		} };
 	}
-	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
-	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
-}
-//#endregion
-//#region src/deploy/dns/index.ts
-/**
-* DNS orchestration for deployments
-*
-* Handles automatic DNS record creation for deployed applications.
-*/
-const logger$2 = require_discover.output;
-/**
-* Check if DNS config is legacy format (single domain with `domain` property)
-*/
-function isLegacyDnsConfig(config) {
-	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
-}
-/**
-* Normalize DNS config to new multi-domain format
-*/
-function normalizeDnsConfig(config) {
-	if (isLegacyDnsConfig(config)) {
-		const { domain, ...providerConfig } = config;
-		return { [domain]: providerConfig };
-	}
-	return config;
-}
-/**
-* Find the root domain for a hostname from available DNS configs
-*
-* @example
-* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
-* // Returns 'geekmidas.com'
-*/
-function findRootDomain(hostname, dnsConfig) {
-	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
-	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
-	return null;
-}
-/**
-* Group hostnames by their root domain
-*/
-function groupHostnamesByDomain(appHostnames, dnsConfig) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const [appName, hostname] of appHostnames) {
-		const rootDomain = findRootDomain(hostname, dnsConfig);
-		if (!rootDomain) {
-			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
-			continue;
-		}
-		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
-		grouped.get(rootDomain).set(appName, hostname);
-	}
-	return grouped;
-}
-/**
-* Resolve IP address from a hostname
-*/
-async function resolveHostnameToIp(hostname) {
-	try {
-		return (await (0, node_dns_promises.lookup)(hostname, { family: 4 })).address;
-	} catch (error) {
-		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
-	}
+};
+/** The provisioner for a kind, or nothing where this target has none yet. */
+function provisionerFor(kind) {
+	return PROVISIONERS[kind];
 }
 /**
-* Extract subdomain from full hostname relative to root domain
+* The role DDL for one database or tenant, from the shared generator.
 *
-* @example
-* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
-* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
-*/
-function extractSubdomain(hostname, rootDomain) {
-	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
-	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
-}
-/**
-* Generate required DNS records for a deployment
-*/
-function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
-	const records = [];
-	for (const [appName, hostname] of appHostnames) {
-		const subdomain = extractSubdomain(hostname, rootDomain);
-		records.push({
-			hostname,
-			subdomain,
-			type: "A",
-			value: serverIp,
-			appName
-		});
-	}
-	return records;
-}
-/**
-* Print DNS records table
-*/
-function printDnsRecordsTable(records, rootDomain) {
-	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
-	for (const record of records) {
-		const subdomain = record.subdomain.padEnd(35);
-		const type = record.type.padEnd(4);
-		const value = record.value.padEnd(15);
-		let status;
-		if (record.error) status = "✗";
-		else if (record.created) status = "✓ new";
-		else if (record.existed) status = "✓";
-		else status = "?";
-		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
-	}
-	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
-}
-/**
-* Print DNS records in a simple format for manual setup
-*/
-function printDnsRecordsSimple(records, rootDomain) {
-	logger$2.log("\n   📋 Required DNS Records:");
-	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$2.log("");
-}
-/**
-* Create DNS records for a single domain using its configured provider
+* The same statements the local target applies and the same ones the AWS
+* bootstrap runs. Dokploy used to write its own, which is how three targets
+* came to hold three definitions of the same split.
 */
-async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
-	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
-	let provider;
-	try {
-		provider = await createDnsProvider({ config: providerConfig });
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			...r,
-			error: message
-		}));
-	}
-	if (!provider) return records.map((r) => ({
-		...r,
-		created: false,
-		existed: false
-	}));
-	const results = [];
-	const upsertRecords = records.map((r) => ({
-		name: r.subdomain,
-		type: r.type,
-		ttl,
-		value: r.value
-	}));
-	try {
-		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
-		for (const [i, record] of records.entries()) {
-			const result = upsertResults[i];
-			if (!result) {
-				results.push({
-					hostname: record.hostname,
-					subdomain: record.subdomain,
-					type: record.type,
-					value: record.value,
-					appName: record.appName,
-					error: "No result returned from provider"
-				});
-				continue;
-			}
-			if (result.unchanged) results.push({
-				hostname: record.hostname,
-				subdomain: record.subdomain,
-				type: record.type,
-				value: record.value,
-				appName: record.appName,
-				existed: true,
-				created: false
-			});
-			else results.push({
-				hostname: record.hostname,
-				subdomain: record.subdomain,
-				type: record.type,
-				value: record.value,
-				appName: record.appName,
-				created: result.created,
-				existed: !result.created
-			});
+function statementsFor(options) {
+	const { id, database, runtime, owner, reader, schema, context } = options;
+	return (0, _geekmidas_db_pg_roles.roleStatements)({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		...options.ownsDatabase ? { database } : {},
+		passwords: {
+			runtime: derivedPassword(context, runtime),
+			owner: derivedPassword(context, owner),
+			...reader ? { reader: derivedPassword(context, reader) } : {}
 		}
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			hostname: r.hostname,
-			subdomain: r.subdomain,
-			type: r.type,
-			value: r.value,
-			appName: r.appName,
-			error: message
-		}));
-	}
-	return results;
+	}).map((statement) => ({
+		...statement,
+		id,
+		database
+	}));
 }
 /**
-* Main DNS orchestration function for deployments
+* The connection string a declared queue or topic publishes on.
 *
-* Supports both legacy single-domain format and new multi-domain format:
-* - Legacy: { provider: 'hostinger', domain: 'example.com' }
-* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+* One broker for the whole project, which is what the local target does and
+* what the runtime expects: the generated pollers open a single connection and
+* subscribe each worker by name on it. So every carrier resolves to the same
+* address, and the DDL that backs it is pushed once however many are declared.
 *
-* @param appHostnames - Map of app names to hostnames
-* @param dnsConfig - DNS configuration (legacy or multi-domain)
-* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
-* @param state - Optional state to save created records for later deletion
+* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
+* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
+* the §4.3 question, and composing a plausible URL for either would fail at the
+* first publish instead of here.
 */
-async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
-	if (!dnsConfig) return null;
-	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$2.log("\n🌐 Setting up DNS records...");
-	let serverIp;
-	try {
-		const endpointUrl = new URL(dokployEndpoint);
-		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
-		return null;
-	}
-	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
-	if (groupedHostnames.size === 0) {
-		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
-		return {
-			records: [],
-			success: true,
-			serverIp
-		};
-	}
-	const allRecords = [];
-	let hasFailures = false;
-	for (const [rootDomain, domainHostnames] of groupedHostnames) {
-		const providerConfig = normalizedConfig[rootDomain];
-		if (!providerConfig) {
-			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
-			continue;
-		}
-		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
-		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
-		if (requiredRecords.length === 0) continue;
-		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
-		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
-		allRecords.push(...domainRecords);
-		const created = domainRecords.filter((r) => r.created).length;
-		const existed = domainRecords.filter((r) => r.existed).length;
-		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
-		if (failed > 0) {
-			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
-			hasFailures = true;
-		}
-		if (state) {
-			for (const record of domainRecords) if (record.created || record.existed) require_sniffer.setDnsRecord(state, {
-				domain: rootDomain,
-				name: record.subdomain,
-				type: record.type,
-				value: record.value,
-				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
-			});
-		}
-		printDnsRecordsTable(domainRecords, rootDomain);
-		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+function broker(id, context) {
+	const backend = context.events ?? "pgboss";
+	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
+	const parentId = soleDatabase(context);
+	if (!parentId) throw new BrokerNeedsADatabase(id);
+	const parentUrl = context.provisioned[parentId]?.provides[(0, _geekmidas_manifest.provideKey)(parentId, "url")];
+	if (!parentUrl) throw new UnresolvedParent(id, parentId);
+	const url = new URL(parentUrl);
+	const database = url.pathname.slice(1);
+	const runtime = `${database}_${PGBOSS_SCHEMA}`;
+	const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
+	if (!context.provisioned[BROKER_ID]) {
+		context.deferred.push(...statementsFor({
+			id: BROKER_ID,
+			database,
+			runtime,
+			owner,
+			schema: PGBOSS_SCHEMA,
+			context
+		}));
+		context.provisioned[BROKER_ID] = { provides: {} };
 	}
-	return {
-		records: allRecords,
-		success: !hasFailures,
-		serverIp
-	};
+	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
+	return { provides: { [(0, _geekmidas_manifest.provideKey)(id, "publisherConnectionString")]: connection } };
 }
+/** The schema pg-boss creates its tables in, here as locally. */
+const PGBOSS_SCHEMA = "pgboss";
 /**
-* Verify DNS records resolve correctly after deployment.
+* The id the broker's DDL is pushed under.
 *
-* This function:
-* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
-* 2. Attempts to resolve each hostname to an IP
-* 3. Compares resolved IP with expected server IP
-* 4. Updates state with verification results
+* Not a construct — no declaration names it — but the deferred statements need
+* an id, and every carrier in the project shares this one.
+*/
+const BROKER_ID = "PgBoss";
+/**
+* A pg-boss address: a Postgres URL under a scheme that picks the transport.
 *
-* @param appHostnames - Map of app names to hostnames
-* @param serverIp - Expected IP address the hostnames should resolve to
-* @param state - Deploy state for caching verification results
-* @returns Array of verification results
+* The protocol is what a producer branches on, so it never branches — the same
+* `.publish()` reaches pg-boss here and SQS on AWS.
 */
-async function verifyDnsRecords(appHostnames, serverIp, state) {
-	const results = [];
-	logger$2.log("\n🔍 Verifying DNS records...");
-	for (const [appName, hostname] of appHostnames) {
-		if (require_sniffer.isDnsVerified(state, hostname, serverIp)) {
-			logger$2.log(`   ✓ ${hostname} (previously verified)`);
-			results.push({
-				hostname,
-				appName,
-				verified: true,
-				expectedIp: serverIp,
-				skipped: true
-			});
-			continue;
-		}
-		try {
-			const resolvedIp = await resolveHostnameToIp(hostname);
-			if (resolvedIp === serverIp) {
-				require_sniffer.setDnsVerification(state, hostname, serverIp);
-				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
-				results.push({
-					hostname,
-					appName,
-					verified: true,
-					resolvedIp,
-					expectedIp: serverIp
-				});
-			} else {
-				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
-				results.push({
-					hostname,
-					appName,
-					verified: false,
-					resolvedIp,
-					expectedIp: serverIp
-				});
-			}
-		} catch (error) {
-			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
-			results.push({
-				hostname,
-				appName,
-				verified: false,
-				expectedIp: serverIp,
-				error: message
-			});
-		}
-	}
-	const verified = results.filter((r) => r.verified).length;
-	const skipped = results.filter((r) => r.skipped).length;
-	const pending = results.filter((r) => !r.verified).length;
-	if (pending > 0) {
-		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
-	return results;
+function pgbossUrl(role, password, host, database) {
+	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
+}
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
+/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
+function s3Url(service, bucket) {
+	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
 }
-//#endregion
-//#region src/deploy/docker.ts
-const logger$1 = require_discover.output;
 /**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
+* A one-service compose file for a bucket.
+*
+* `dokploy-network` is external and already exists — it is what every Dokploy
+* service is attached to, and joining it is what makes the app able to resolve
+* this one by name. The bucket itself is created by MinIO's entrypoint rather
+* than by a second call, so there is nothing to reconcile afterwards.
 */
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
+function minioCompose(options) {
+	const { service, bucket, user, password } = options;
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+		`    command: server /data --console-address ":9001"`,
+		"    environment:",
+		`      MINIO_ROOT_USER: ${user}`,
+		`      MINIO_ROOT_PASSWORD: ${password}`,
+		"    volumes:",
+		`      - ${service}-data:/data`,
+		"    networks:",
+		"      - dokploy-network",
+		"    healthcheck:",
+		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
+		"      interval: 10s",
+		"      retries: 5",
+		`  ${service}-bucket:`,
+		"    image: minio/mc:latest",
+		"    depends_on:",
+		`      ${service}:`,
+		"        condition: service_healthy",
+		"    entrypoint: >",
+		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
+		`      mc mb --ignore-existing s3/${bucket}"`,
+		"    networks:",
+		"      - dokploy-network",
+		"volumes:",
+		`  ${service}-data:`,
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/** Whether anything reads through a reader on this construct. */
+function readsFrom(manifest, id) {
+	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
+}
+/** The schema a database or tenant pins on its roles. */
+function schemaOf(manifest, id) {
+	const declaration = manifest[id];
+	if (declaration?.kind === "database") return declaration.schema ?? "app";
+	if (declaration?.kind === "database-schema") return declaration.schema;
+}
+/**
+* The one declared database, where `cache: 'db'` has to pick.
+*
+* Unambiguous with one and arbitrary with two, so two is an error rather than a
+* coin toss — a cache landing in a database nobody chose surfaces as entries
+* that are never found, long after the deploy reported success.
+*/
+function soleDatabase(context) {
+	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
+	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
+	return databases[0];
+}
 /**
-* Get the full image reference
+* A password derived from the stage's seed, the project, the stage and the role.
+*
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
 */
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
+function derivedPassword(context, role) {
+	return (0, node_crypto.createHash)("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/** A connection string for a role on a cluster. */
+function postgresUrl(role, password, host, database) {
+	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
+}
+/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
+function quoted(name) {
+	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
 }
+/** A provisioner was handed a declaration of the wrong kind. */
 /**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
+* A value only the stage's own secrets can hold.
 *
-* @internal Exported for testing
+* @throws {MissingSuppliedSecret} when the stage was never given it.
 */
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
 }
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends Error {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
+var WrongKind = class extends Error {
+	kind;
+	constructor(kind) {
+		super(`No Dokploy provisioner handles '${kind}'`);
+		this.kind = kind;
+		this.name = "WrongKind";
+	}
+};
+/** A derived construct whose parent has not been provisioned. */
+var UnresolvedParent = class extends Error {
+	id;
+	parent;
+	constructor(id, parent) {
+		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
+		this.id = id;
+		this.parent = parent;
+		this.name = "UnresolvedParent";
+	}
+};
+/** A cache with nowhere to live. */
+var CacheNeedsAHome = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
+		this.id = id;
+		this.backend = backend;
+		this.name = "CacheNeedsAHome";
+	}
+};
+/** A `'db'` cache (a server target's default) with more than one database. */
+var CacheIsAmbiguous = class extends Error {
+	databases;
+	constructor(databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+/** A surface reached provisioning before its domain existed. */
+var SurfaceHasNoAddress = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
+		this.id = id;
+		this.name = "SurfaceHasNoAddress";
+	}
+};
+/** A queue or topic on a backend this target has no primitive for. */
+var UnprovisionableCarrier = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableCarrier";
+	}
+};
+/** A pg-boss carrier in an app that declares no database to host it. */
+var BrokerNeedsADatabase = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
+		this.id = id;
+		this.name = "BrokerNeedsADatabase";
+	}
+};
+/** A bucket on a backend this target has no primitive for. */
+var UnprovisionableBucket = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableBucket";
+	}
+};
+//#endregion
+//#region src/target/dokploy/declared.ts
 /**
-* Write the encrypted credentials where `docker build --secret` reads them.
+* The declared half of a Dokploy deploy.
 *
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
+* `fromManifest.ts` decides what each construct resolves to; this runs it —
+* discovers the manifest, walks it parents-first, and applies the DDL the
+* provisioners deferred.
 *
-* @internal Exported for testing
+* It is deliberately separate from the engine in `index.ts`. That file deploys
+* *applications*: images, registries, domains, the things a project has whether
+* or not it declares anything. This is the part that exists because the app
+* declared it, and keeping the two apart is what lets a project adopt the model
+* without rewriting its deploy — and lets this one be tested without one.
 */
-async function writeCredentialsFile(credentials) {
-	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
-	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
-	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
-	await (0, node_fs_promises.chmod)(path, 384);
+/**
+* Provision everything the workspace declares, and return what it resolved.
+*/
+async function provisionDeclared(options) {
+	const { workspace } = options;
+	const empty = {
+		env: {},
+		statements: [],
+		provisioned: {},
+		clusters: {}
+	};
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: require_state.constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	if (Object.keys(manifest).length === 0) return empty;
+	const context = {
+		manifest,
+		provisioned: {},
+		api: options.api,
+		projectId: options.projectId,
+		environmentId: options.environmentId,
+		stage: options.stage,
+		project: workspace.name,
+		scope: options.scope ?? workspace.name,
+		cache: require_state.cacheBackendFor(require_state.providerOf(workspace)),
+		events: require_state.eventsBackendFor(require_state.providerOf(workspace)),
+		storage: require_state.storageBackendFor(require_state.providerOf(workspace)),
+		addresses: surfaceAddresses(manifest, options.appUrls),
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
+		deferred: [],
+		clusters: {}
+	};
+	const env = {};
+	for (const id of carriersLast((0, _geekmidas_manifest.provisionOrder)(manifest), manifest)) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const provisioner = provisionerFor(declaration.kind);
+		if (!provisioner) continue;
+		const result = await provisioner(declaration, context);
+		context.provisioned[id] = result;
+		Object.assign(env, result.provides);
+	}
 	return {
-		path,
-		cleanup: () => (0, node_fs_promises.rm)(dir, {
-			recursive: true,
-			force: true
-		})
+		env,
+		statements: context.deferred.map((statement) => ({
+			id: statement.id,
+			describe: statement.describe,
+			...statement.database ? { database: statement.database } : {},
+			...statement.exists ? { exists: statement.exists } : {},
+			create: statement.sql
+		})),
+		provisioned: context.provisioned,
+		clusters: context.clusters
 	};
 }
 /**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
+* Run the deferred DDL against a cluster that is now reachable.
+*
+* The same applier the local target uses: every statement asks whether it is
+* needed first, so a redeploy is free and a half-applied run recovers by being
+* run again.
 */
-async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
-	logger$1.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$1.log("   Generating Dockerfile for the pre-built bundle...");
-	await require_sniffer.dockerCommand({
-		slim: true,
-		cwd
-	});
-	const dockerfilePath = (0, node_path.join)(cwd, ".gkm", "docker", "Dockerfile");
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await require_local.run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs,
-			credentialsFile: secret?.path
-		}), {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$1.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new require_sniffer.DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
+async function applyDeclared(client, statements) {
+	return (await require_state.applyPostgres(client, statements)).filter((entry) => entry.created).length;
+}
+/**
+* The provisioning order, with queues and topics moved to the end.
+*
+* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
+* *derived from* a database, because under SNS it does not live in one. Where
+* it lives is a fact about the backend, which is config — so the dependency is
+* real under pg-boss and absent under SNS, and writing it into the declaration
+* would state it in the one place that cannot know.
+*
+* Here it can. This runs where the backend is known, and the rule needs no
+* branch on it: nothing depends on a carrier. A queue's worker and a topic's
+* subscribers are *bound* to it rather than dependent on it, which is why
+* neither holds a key of its own — so a carrier can always go last, and under
+* pg-boss that is exactly late enough for the database it reads to be there.
+*/
+function carriersLast(ordered, manifest) {
+	const carries = (id) => {
+		const kind = manifest[id]?.kind;
+		return kind === "queue" || kind === "topic";
+	};
+	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
 }
 /**
-* Push Docker image to registry
+* Where each declared surface answers: its own app's address.
+*
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
 */
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await require_local.run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$1.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new require_sniffer.DockerPushFailed(imageRef, error);
+function surfaceAddresses(manifest, appUrls) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[require_derive.appKey(id)];
+		if (url) addresses[id] = url;
 	}
+	return addresses;
 }
+//#endregion
+//#region src/target/dokploy/dns/DnsProvider.ts
 /**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
+* Check if value is a DnsProvider implementation.
 */
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await require_local.runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
 }
 /**
-* Deploy using Docker (build and optionally push image)
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
 */
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = require_sniffer.validateImageRef(getImageRef(config.registry, imageName, tag));
-	const docker = {
-		cwd: options.cwd ?? process.cwd(),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger$1.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BznqRC2S.cjs"));
+		return new HostingerProvider();
 	}
-	logger$1.log("\n✅ Docker deployment ready!");
-	logger$1.log(`\n📋 Deployment details:`);
-	logger$1.log(`   Image: ${imageRef}`);
-	logger$1.log(`   Stage: ${stage}`);
-	if (masterKey) logger$1.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	if (provider === "route53") {
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-Bllus2NR.cjs"));
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
+		});
+	}
+	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
+	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
 }
 //#endregion
-//#region src/deploy/env-resolver.ts
+//#region src/target/dokploy/dns/index.ts
 /**
-* Environment Variable Resolution for Dokploy Deployments
+* DNS orchestration for deployments
 *
-* Resolves sniffed environment variables to actual values during deployment.
-* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
-* and falls back to user-provided secrets.
+* Handles automatic DNS record creation for deployed applications.
 */
+const logger$2 = require_discover.output;
 /**
-* Generate a secure random secret (64 hex characters = 32 bytes)
+* Check if DNS config is legacy format (single domain with `domain` property)
 */
-function generateSecret() {
-	return (0, node_crypto.randomBytes)(32).toString("hex");
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
 }
 /**
-* Get or generate a secret for an app.
-* If the secret already exists in state, returns it.
-* Otherwise generates a new one and stores it.
+* Normalize DNS config to new multi-domain format
 */
-function getOrGenerateSecret(state, appName, secretName) {
-	const existing = require_sniffer.getGeneratedSecret(state, appName, secretName);
-	if (existing) return existing;
-	const generated = generateSecret();
-	require_sniffer.setGeneratedSecret(state, appName, secretName, generated);
-	return generated;
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
+	}
+	return config;
 }
 /**
-* Resolve a single environment variable
+* Find the root domain for a hostname from available DNS configs
+*
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
 */
-function resolveEnvVar(varName, context) {
-	switch (varName) {
-		case "PORT": return String(context.app.port);
-		case "NODE_ENV": return "production";
-		case "STAGE": return context.stage;
-		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
-		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
-		case "BETTER_AUTH_TRUSTED_ORIGINS":
-			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
-			break;
-		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
-	}
-	if (context.dependencyUrls && varName.endsWith("_URL")) {
-		const depName = (require_workspace.stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
-		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
-	}
-	if (context.userSecrets) {
-		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
-		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
-		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
-		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
-	}
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
 }
 /**
-* Resolve all environment variables for an app
+* Group hostnames by their root domain
 */
-function resolveEnvVars(requiredVars, context) {
-	const resolved = {};
-	const missing = [];
-	for (const varName of requiredVars) {
-		const value = resolveEnvVar(varName, context);
-		if (value !== void 0) resolved[varName] = value;
-		else missing.push(varName);
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
 	}
-	return {
-		resolved,
-		missing
-	};
+	return grouped;
 }
 /**
-* Format missing variables error message
+* Resolve IP address from a hostname
 */
-function formatMissingVarsError(appName, missing, stage) {
-	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await (0, node_dns_promises.lookup)(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
 }
 /**
-* Validate that all required environment variables can be resolved
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
 */
-function validateEnvVars(requiredVars, context) {
-	const { resolved, missing } = resolveEnvVars(requiredVars, context);
-	return {
-		valid: missing.length === 0,
-		missing,
-		resolved
-	};
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
 }
-//#endregion
-//#region src/deploy/journal.ts
-var DeployJournal = class DeployJournal {
-	store;
-	stage;
-	state;
-	resources;
-	version;
-	existed;
-	constructor(store, stage, state, resources, version, existed) {
-		this.store = store;
-		this.stage = stage;
-		this.state = state;
-		this.resources = resources;
-		this.version = version;
-		this.existed = existed;
-	}
-	/**
-	* The stage's journal — its stored state, or `initial` written as the
-	* stage's first state, so there is somewhere to record the very first
-	* resource before it is created.
-	*/
-	static async open(store, stage, initial) {
-		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
-		const state = initial();
-		const version = await store.write(stage, state, { expectedVersion: null });
-		return new DeployJournal(store, stage, state, {}, version, false);
-	}
-	record(key) {
-		return this.resources[key];
-	}
-	/** The keys a previous run marked `pending` and never saw created. */
-	unfinished() {
-		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
-	}
-	/** Records that `entry` is about to be created. */
-	async pending(entry) {
-		await this.put({
-			...entry,
-			status: "pending"
-		});
-	}
-	/** Records `entry` as existing with `id`; a no-op if it already is. */
-	async ready(entry, id) {
-		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id) return;
-		await this.put({
-			...entry,
-			status: "ready",
-			id
+/**
+* Generate required DNS records for a deployment
+*/
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
 		});
 	}
-	/**
-	* The resource `entry` names: by its recorded id, else by looking it up,
-	* else created — with `pending` written before the create and `ready`
-	* after, so a run that dies in between leaves a record the next run
-	* resolves by looking the resource up rather than creating another.
-	*/
-	async ensure(entry, steps) {
-		const record = this.resources[entry.key];
-		let staleId;
-		if (record?.status === "ready" && record.id && steps.get) {
-			const known = await steps.get(record.id);
-			if (known) {
-				await this.ready(entry, steps.id(known));
-				return {
-					resource: known,
-					via: "recorded"
-				};
-			}
-			staleId = record.id;
-		}
-		const existing = await steps.find();
-		if (existing) {
-			await this.ready(entry, steps.id(existing));
-			return {
-				resource: existing,
-				via: record?.status === "pending" ? "resumed" : "found",
-				...staleId ? { staleId } : {}
-			};
-		}
-		await this.pending(entry);
-		const created = await steps.create();
-		await this.ready(entry, steps.id(created));
-		return {
-			resource: created,
-			via: "created",
-			...staleId ? { staleId } : {}
-		};
-	}
-	/** Writes the stage's state, keeping its resource records. */
-	async save() {
-		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
-	}
-	async put(record) {
-		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
-		this.resources = {
-			...this.resources,
-			[record.key]: {
-				...record,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		};
+	return records;
+}
+/**
+* Print DNS records table
+*/
+function printDnsRecordsTable(records, rootDomain) {
+	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-};
-//#endregion
-//#region src/deploy/ownership.ts
+	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+}
 /**
-* Which Dokploy project a deploy is allowed to deploy into.
-*
-* Deploy used to take any project whose name matched the workspace's, in any
-* case — so a second workspace called `shop` (or `Shop`) on the same server
-* deployed into the first one's project, over its images and applications. A
-* project is now claimed by an ownership marker in its description, and a
-* project with the right name and no marker is somebody else's.
+* Print DNS records in a simple format for manual setup
 */
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$2.log("\n   📋 Required DNS Records:");
+	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$2.log("");
+}
 /**
-* A Dokploy project with the name this deploy would use exists, and nothing
-* says this workspace created it.
+* Create DNS records for a single domain using its configured provider
 */
-var ProjectNotOwned = class extends Error {
-	projectName;
-	projectId;
-	identity;
-	ownedBy;
-	constructor(projectName, projectId, identity, ownedBy) {
-		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
-		this.projectName = projectName;
-		this.projectId = projectId;
-		this.identity = identity;
-		this.ownedBy = ownedBy;
-		this.name = "ProjectNotOwned";
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
 	}
-};
-/** A description with the marker added, keeping what was there. */
-function withMarker(description, marker) {
-	const existing = (description ?? "").trim();
-	return existing ? `${existing}\n${marker}` : marker;
-}
-/** `project.one`, or `null` when Dokploy no longer has the project. */
-async function projectById(api, projectId) {
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
 	try {
-		return await api.getProject(projectId) ?? null;
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
 	} catch (error) {
-		if (error instanceof require_sniffer.DokployApiError) return null;
-		throw error;
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
 	}
+	return results;
 }
 /**
-* The project this identity owns, if there is one — read only, so a dry run
-* asks the same question a deploy does:
+* Main DNS orchestration function for deployments
 *
-* 1. The one the stage's state names, if Dokploy still has it. State written
-*    before markers existed is trusted — it holds an id this workspace was
-*    given when it created the project.
-* 2. One with this name *and* this identity's marker.
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
 *
-* A project that matches by name (in any case) but carries no marker, or
-* another identity's, raises `ProjectNotOwned` — it is never adopted.
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
 */
-async function findProject(api, identity, stateProjectId) {
-	const name = require_store.projectName(identity);
-	const marker = require_store.ownershipMarker(identity);
-	if (stateProjectId) {
-		const known = await projectById(api, stateProjectId);
-		if (known) {
-			const claimed = require_store.markerOf(known.description);
-			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
-			return {
-				projectId: known.projectId,
-				name: known.name,
-				description: known.description ?? null,
-				environments: known.environments ?? [],
-				via: "state",
-				needsClaim: !claimed
-			};
-		}
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$2.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
 	}
-	const projects = await api.listProjects();
-	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && require_store.isOwnedBy(p.description, identity));
-	if (owned) {
-		const details = await api.getProject(owned.projectId);
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
-			projectId: owned.projectId,
-			name: owned.name,
-			description: owned.description ?? null,
-			environments: details.environments ?? [],
-			via: "marker",
-			needsClaim: false
+			records: [],
+			success: true,
+			serverIp
 		};
 	}
-	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
-	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, require_store.markerOf(clash.description));
-	return null;
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
+		}
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) require_state.setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+	}
+	return {
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
+	};
 }
 /**
-* The project this deploy deploys into: the one {@link findProject} finds —
-* claimed with this identity's marker if it carries none yet, so the next
-* deploy without state still finds it — or a new one, marked.
+* Verify DNS records resolve correctly after deployment.
+*
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
 */
-async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
-	const marker = require_store.ownershipMarker(identity);
-	const found = await findProject(api, identity, stateProjectId);
-	if (found) {
-		if (found.needsClaim) {
-			await api.updateProject(found.projectId, {
-				name: found.name,
-				description: withMarker(found.description, marker)
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$2.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (require_state.isDnsVerified(state, hostname, serverIp)) {
+			logger$2.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				require_state.setDnsVerification(state, hostname, serverIp);
+				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
 			});
-			log(`   Claimed project ${found.name} for ${identity.key}`);
 		}
-		return {
-			projectId: found.projectId,
-			name: found.name,
-			environments: found.environments,
-			via: found.via
-		};
 	}
-	await hooks.beforeCreate?.();
-	const created = await api.createProject(require_store.projectName(identity), withMarker("Deployed by gkm.", marker));
-	return {
-		projectId: created.project.projectId,
-		name: created.project.name,
-		environments: [created.environment],
-		via: "created"
-	};
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
 }
 //#endregion
-//#region src/deploy/registry.ts
+//#region src/target/dokploy/env-resolver.ts
 /**
-* Which Dokploy registry a stage's images are pulled through.
+* Environment Variable Resolution for Dokploy Deployments
 *
-* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
-* when that was empty, the first registry Dokploy listed — so an image could be
-* deployed with credentials for a registry nobody chose, and two workspaces
-* deployed from one machine shared whichever was stored last. The id is now
-* kept in the stage's state, and found only from what the workspace
-* configured.
+* Resolves sniffed environment variables to actual values during deployment.
+* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
+* and falls back to user-provided secrets.
 */
-/** There is nowhere to push images to, so Dokploy has nothing to pull. */
-var RegistryNotConfigured = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.dokploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
-		this.stage = stage;
-		this.name = "RegistryNotConfigured";
-	}
-};
-/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
-var RegistryNotFound = class extends Error {
-	registryId;
-	constructor(registryId) {
-		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
-		this.registryId = registryId;
-		this.name = "RegistryNotFound";
-	}
-};
-/** More than one Dokploy registry serves the configured registry. */
-var RegistryAmbiguous = class extends Error {
-	registry;
-	registryIds;
-	constructor(registry, registryIds) {
-		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
-		this.registry = registry;
-		this.registryIds = registryIds;
-		this.name = "RegistryAmbiguous";
-	}
-};
-/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
-function parts(url) {
-	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
-	return {
-		host,
-		path: path.join("/")
-	};
-}
 /**
-* The Dokploy registries that serve `registry`: the same host, and — where
-* Dokploy's own entry names one — the same path.
+* Generate a secure random secret (64 hex characters = 32 bytes)
 */
-function serving(registries, registry) {
-	const wanted = parts(registry);
-	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
-	if (sameHost.length <= 1) return sameHost;
-	return sameHost.filter((r) => {
-		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
-	});
+function generateSecret() {
+	return (0, node_crypto.randomBytes)(32).toString("hex");
 }
-/** `registry.one`, or `null` when Dokploy says it has no such registry. */
-async function registryById(api, registryId) {
-	try {
-		return await api.getRegistry(registryId) ?? null;
-	} catch (error) {
-		if (error instanceof require_sniffer.DokployApiError) return null;
-		throw error;
-	}
+/**
+* Get or generate a secret for an app.
+* If the secret already exists in state, returns it.
+* Otherwise generates a new one and stores it.
+*/
+function getOrGenerateSecret(state, appName, secretName) {
+	const existing = require_state.getGeneratedSecret(state, appName, secretName);
+	if (existing) return existing;
+	const generated = generateSecret();
+	require_state.setGeneratedSecret(state, appName, secretName, generated);
+	return generated;
 }
 /**
-* The registry id for a stage, in order: the configured id, the one in the
-* stage's state, the one Dokploy has for the configured registry URL, and
-* otherwise a new one. Never a registry the workspace did not point at.
+* Resolve a single environment variable
 */
-async function resolveRegistry(api, options) {
-	const { stage, registry, configuredId, stateId, log = () => {} } = options;
-	if (!registry) throw new RegistryNotConfigured(stage);
-	if (configuredId) {
-		const configured = await registryById(api, configuredId);
-		if (!configured) throw new RegistryNotFound(configuredId);
-		return configured;
+function resolveEnvVar(varName, context) {
+	switch (varName) {
+		case "PORT": return String(context.app.port);
+		case "NODE_ENV": return "production";
+		case "STAGE": return context.stage;
+		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
+		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
+		case "BETTER_AUTH_TRUSTED_ORIGINS":
+			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
+			break;
+		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
 	}
-	if (stateId) {
-		const known = await registryById(api, stateId);
-		if (known) return known;
-		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	if (context.dependencyUrls && varName.endsWith("_URL")) {
+		const depName = (require_workspace.stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
+		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
+	}
+	if (context.userSecrets) {
+		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
+		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
+		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
+		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
 	}
-	const matches = serving(await api.listRegistries(), registry);
-	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
-	if (matches[0]) return matches[0];
-	return options.create(registry);
 }
-//#endregion
-//#region src/deploy/secrets.ts
 /**
-* Filter secrets to only include the env vars that an app requires.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
-* @returns Filtered secrets with found/missing tracking
+* Resolve all environment variables for an app
 */
-function filterSecretsForApp(stageSecrets, sniffedEnv) {
-	const allSecrets = require_storage.toEmbeddableSecrets(stageSecrets);
-	const filtered = {};
-	const found = [];
+function resolveEnvVars(requiredVars, context) {
+	const resolved = {};
 	const missing = [];
-	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
-		filtered[key] = allSecrets[key];
-		found.push(key);
-	} else missing.push(key);
+	for (const varName of requiredVars) {
+		const value = resolveEnvVar(varName, context);
+		if (value !== void 0) resolved[varName] = value;
+		else missing.push(varName);
+	}
 	return {
-		appName: sniffedEnv.appName,
-		secrets: filtered,
-		found: found.sort(),
-		missing: missing.sort()
+		resolved,
+		missing
 	};
 }
 /**
-* Encrypt filtered secrets for an app.
-* Generates an ephemeral master key that should be injected into Dokploy.
-*
-* @param filteredSecrets - The filtered secrets for the app
-* @returns Encrypted payload with master key
+* Format missing variables error message
 */
-function encryptSecretsForApp(filteredSecrets) {
-	const payload = require_sniffer.encryptSecrets(filteredSecrets.secrets);
-	return {
-		appName: filteredSecrets.appName,
-		payload,
-		masterKey: payload.masterKey,
-		secretCount: Object.keys(filteredSecrets.secrets).length,
-		missingSecrets: filteredSecrets.missing
-	};
+function formatMissingVarsError(appName, missing, stage) {
+	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
 }
 /**
-* Filter and encrypt secrets for an app in one step.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
-* @returns Encrypted secrets with master key
+* Validate that all required environment variables can be resolved
 */
-function prepareSecretsForApp(stageSecrets, sniffedEnv) {
-	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+function validateEnvVars(requiredVars, context) {
+	const { resolved, missing } = resolveEnvVars(requiredVars, context);
+	return {
+		valid: missing.length === 0,
+		missing,
+		resolved
+	};
 }
-/**
-* Prepare secrets for multiple apps.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedApps - Map of app name to sniffed environment
-* @returns Map of app name to encrypted secrets
-*/
-function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
-	const results = /* @__PURE__ */ new Map();
-	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
-		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
-		results.set(appName, encrypted);
+//#endregion
+//#region src/target/dokploy/health.ts
+/** How long one request may take: a check that hangs is a failed check. */
+const REQUEST_TIMEOUT_MS = 1e4;
+/** An app never answered healthy enough times in a row. */
+var HealthCheckTimedOut = class extends Error {
+	app;
+	url;
+	timeoutMs;
+	lastStatus;
+	constructor(app, url, timeoutMs, lastStatus) {
+		super(`${app} did not become healthy within ${Math.round(timeoutMs / 1e3)}s: ${url} last ${lastStatus === void 0 ? "did not answer" : `answered ${lastStatus}`}. Check the app's logs in Dokploy. If it is only slow to start, raise deploy.dokploy.verify.healthTimeoutMs; if it serves its health route elsewhere, set deploy.dokploy.verify.healthCheckPath.`);
+		this.app = app;
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "HealthCheckTimedOut";
+	}
+};
+/** Wait `ms`, or reject with the signal's reason once it aborts. */
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) return reject(signal.reason);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal.reason);
+		};
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** One request: its status, or undefined when it never answered. */
+async function probe(url, signal) {
+	try {
+		const response = await fetch(url, { signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) });
+		response.body?.cancel().catch(() => {});
+		return response.status;
+	} catch {
+		signal.throwIfAborted();
+		return;
 	}
-	return results;
 }
 /**
-* Generate a report on secrets preparation.
-*/
-function generateSecretsReport(encryptedApps, sniffedApps) {
-	const appsWithSecrets = [];
-	const appsWithoutSecrets = [];
-	const appsWithMissingSecrets = [];
-	for (const [appName, sniffedEnv] of sniffedApps) {
-		if (sniffedEnv.requiredEnvVars.length === 0) {
-			appsWithoutSecrets.push(appName);
-			continue;
-		}
-		const encrypted = encryptedApps.get(appName);
-		if (encrypted) {
-			appsWithSecrets.push(appName);
-			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
-				appName,
-				missing: encrypted.missingSecrets
+* Check `url` until it answers 2xx `healthyAfter` times in a row, emitting
+* `health.checked` for every check.
+*
+* @throws {HealthCheckTimedOut} when that has not happened within `timeoutMs`.
+*/
+async function verifyHealth(check) {
+	const { app, url, healthyAfter, intervalMs, timeoutMs, signal, emit } = check;
+	const deadline = Date.now() + timeoutMs;
+	let consecutive = 0;
+	let attempt = 0;
+	while (true) {
+		attempt++;
+		const status = await probe(url, signal);
+		const healthy = status !== void 0 && status >= 200 && status < 300;
+		emit({
+			type: "health.checked",
+			app,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		consecutive = healthy ? consecutive + 1 : 0;
+		if (consecutive >= healthyAfter) return;
+		if (Date.now() + intervalMs > deadline) throw new HealthCheckTimedOut(app, url, timeoutMs, status);
+		await sleep(intervalMs, signal);
+	}
+}
+/** The migrations of a deployed stage failed; the release stopped before any app. */
+var DeployMigrationsFailed = class extends Error {
+	stage;
+	reason;
+	constructor(stage, reason, message) {
+		super(`Migrating "${stage}" failed, so no app was released: ${message}. Migrations applied before the failing one stay applied; fix it and deploy again.`);
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "DeployMigrationsFailed";
+	}
+};
+/**
+* The URLs a stage's migrations connect with, keyed as the migrator reads
+* them, grouped by the database their cluster serves — for the targets that
+* have a migration to apply. Empty when none does, so a deploy publishes
+* nothing for a project that has not written one.
+*/
+async function migrationUrls(root, manifest, env) {
+	const byDatabase = /* @__PURE__ */ new Map();
+	for (const target of (0, _geekmidas_manifest.migrationTargets)(manifest)) {
+		if ((await require_provider.migrationFiles((0, node_path.join)(root, target.migrations))).size === 0) continue;
+		for (const role of ["ownerUrl", "url"]) {
+			const key = (0, _geekmidas_manifest.provideKey)(target.id, role);
+			const url = env[key];
+			if (!url) continue;
+			const database = new URL(url).pathname.slice(1);
+			byDatabase.set(database, {
+				...byDatabase.get(database),
+				[key]: url
 			});
 		}
 	}
-	return {
-		totalApps: sniffedApps.size,
-		appsWithSecrets: appsWithSecrets.sort(),
-		appsWithoutSecrets: appsWithoutSecrets.sort(),
-		appsWithMissingSecrets
-	};
+	return byDatabase;
+}
+const answer = require_schemas.discriminatedUnion("reason", [require_schemas.object({
+	reason: require_schemas.literal("migrated"),
+	runs: require_schemas.array(require_schemas.object({
+		migrations: require_schemas.string(),
+		applied: require_schemas.array(require_schemas.string())
+	}))
+}), require_schemas.object({
+	reason: require_schemas.literal("failed"),
+	error: require_schemas.looseObject({
+		name: require_schemas.string(),
+		message: require_schemas.string()
+	})
+})]);
+/** Apply every pending migration, in the sandbox, as each construct's owner. */
+async function runMigrations(options) {
+	const sandbox = options.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: options.root });
+	const { value } = await require_discover.runWorker(sandbox, "migrations", {
+		name: "migrate-worker",
+		args: [JSON.stringify({
+			root: options.root,
+			manifest: options.manifest,
+			patterns: options.patterns
+		})],
+		cwd: options.root,
+		timeoutMs: options.timeoutMs ?? 9e5,
+		secrets: options.urls,
+		signal: options.signal,
+		schema: answer
+	});
+	if (value.reason === "failed") throw new DeployMigrationsFailed(options.stage, value.error.name, value.error.message);
+	return value.runs;
 }
 //#endregion
-//#region src/deploy/index.ts
+//#region src/target/dokploy/postgres.ts
 /**
-* Deploy Module
-*
-* Handles deployment of GKM workspaces to various providers (Docker, Dokploy).
-*
-* ## Per-App Database Credentials
-*
-* When deploying to Dokploy with Postgres, this module creates per-app database
-* users with isolated schemas. This follows the same pattern as local dev mode
-* (docker/postgres/init.sh).
-*
-* ### How It Works
+* Reaching a Dokploy Postgres from where the deploy runs.
 *
-* 1. **Provisioning**: Creates Postgres service with master credentials
-* 2. **User Creation**: For each backend app that needs DATABASE_URL:
-*    - Generates a unique password (stored in deploy state)
-*    - Creates a database user with that password
-*    - Assigns schema permissions based on app name
-* 3. **Schema Assignment**:
-*    - `api` app: Uses `public` schema (shared tables)
-*    - Other apps (e.g., `auth`): Get their own schema with `search_path` set
-* 4. **Environment Injection**: Each app receives its own DATABASE_URL
-*
-* ### Security
-*
-* - External Postgres port is enabled only during user creation, then disabled
-* - Each app can only access its own schema
-* - Credentials are stored in `.gkm/deploy-{stage}.json` (gitignored)
-* - Subsequent deploys reuse existing credentials from state
-*
-* ### Example Flow
-*
-* ```
-* gkm deploy --stage production
-*   ├─ Create Postgres (user: postgres, db: myproject)
-*   ├─ Enable external port temporarily
-*   ├─ Create user "api" → public schema
-*   ├─ Create user "auth" → auth schema (search_path=auth)
-*   ├─ Disable external port
-*   ├─ Deploy "api" with DATABASE_URL=postgresql://api:xxx@postgres:5432/myproject
-*   └─ Deploy "auth" with DATABASE_URL=postgresql://auth:yyy@postgres:5432/myproject
-* ```
-*
-* @module deploy
+* A Dokploy Postgres answers on the server's Docker network and nowhere else:
+* its address is its service name, which only another container there
+* resolves. Two steps of a deploy need it from outside — the role DDL the
+* provisioners defer, and the migrations `release` applies — so the cluster
+* is published on an external port for exactly as long as they take, and
+* closed again whatever happens.
 */
-const logger = require_discover.output;
+const logger$1 = require_discover.output;
+/** A Postgres published for the role DDL never accepted a connection. */
+var PostgresNotReady = class extends Error {
+	host;
+	port;
+	attempts;
+	constructor(host, port, attempts) {
+		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
+		this.host = host;
+		this.port = port;
+		this.attempts = attempts;
+		this.name = "PostgresNotReady";
+	}
+};
+/** No port could be published for a cluster, so its DDL cannot reach it. */
+var PostgresPortUnavailable = class extends Error {
+	appName;
+	taken;
+	constructor(appName, taken) {
+		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
+		this.appName = appName;
+		this.taken = taken;
+		this.name = "PostgresPortUnavailable";
+	}
+};
 /**
 * Wait for Postgres to be ready to accept connections.
 *
@@ -1878,14 +1902,7 @@ const logger = require_discover.output;
 * Used after enabling the external port to ensure the database is accessible
 * before creating users.
 *
-* @param host - The Postgres server hostname
-* @param port - The external port (typically 5432)
-* @param user - Master database user (postgres)
-* @param password - Master database password
-* @param database - Database name to connect to
-* @param maxRetries - Maximum number of connection attempts (default: 30)
-* @param retryIntervalMs - Milliseconds between retries (default: 2000)
-* @throws Error if Postgres is not ready after maxRetries
+* @throws {PostgresNotReady} if Postgres is not ready after maxRetries
 */
 async function waitForPostgres(host, port, user, password, database, maxRetries = 30, retryIntervalMs = 2e3) {
 	for (let i = 0; i < maxRetries; i++) try {
@@ -1903,49 +1920,12 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 		return;
 	} catch {
 		if (i < maxRetries - 1) {
-			logger.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			logger$1.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
 			await new Promise((r) => setTimeout(r, retryIntervalMs));
 		}
 	}
 	throw new PostgresNotReady(host, port, maxRetries);
 }
-/** A Postgres published for the role DDL never accepted a connection. */
-var PostgresNotReady = class extends Error {
-	host;
-	port;
-	attempts;
-	constructor(host, port, attempts) {
-		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
-		this.host = host;
-		this.port = port;
-		this.attempts = attempts;
-		this.name = "PostgresNotReady";
-	}
-};
-/** No port could be published for a cluster, so its DDL cannot reach it. */
-var PostgresPortUnavailable = class extends Error {
-	appName;
-	taken;
-	constructor(appName, taken) {
-		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
-		this.appName = appName;
-		this.taken = taken;
-		this.name = "PostgresPortUnavailable";
-	}
-};
-/**
-* Run the manifest's DDL against a Dokploy Postgres.
-*
-* The cluster is only reachable from outside while an external port is
-* published, so this opens one, applies, and leaves it as it found it. The
-* alternative — running DDL from inside the network — needs a container to run
-* it in, which is what `DatabaseBootstrap` is on AWS and what a Dokploy target
-* has no equivalent for yet.
-*
-* The applier is the local target's, so every statement asks whether it is
-* needed first: a redeploy is free, and a half-applied run recovers by being
-* run again.
-*/
 /**
 * A high port for one service, the same one every time.
 *
@@ -1958,32 +1938,80 @@ function derivedPort(appName) {
 	const digest = (0, node_crypto.createHash)("sha256").update(appName).digest();
 	return 49152 + (digest[0] << 8 | digest[1]) % 16e3;
 }
-async function applyDeclaredStatements(api, postgres, serverHostname, statements) {
-	let externalPort = await api.getPostgres(postgres.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
+/** The hostname of the Dokploy server, from its API endpoint. */
+function serverHostname(endpoint) {
+	return new URL(endpoint).hostname;
+}
+/**
+* Publish `cluster` on an external port of the server at `host`, and wait
+* until it accepts a connection there.
+*/
+async function publishPostgres(api, cluster, host) {
+	let externalPort = await api.getPostgres(cluster.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
 	const opened = externalPort === void 0;
 	if (externalPort === void 0) {
 		const taken = await api.publishedPorts().catch(() => /* @__PURE__ */ new Set());
-		const candidates = [5432, derivedPort(postgres.appName)].filter((port) => !taken.has(port));
+		const candidates = [5432, derivedPort(cluster.appName)].filter((port) => !taken.has(port));
 		for (const candidate of candidates) try {
-			await api.savePostgresExternalPort(postgres.postgresId, candidate);
+			await api.savePostgresExternalPort(cluster.postgresId, candidate);
 			externalPort = candidate;
 			break;
 		} catch (error) {
 			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
-			logger.log(`   Port ${candidate} is taken; trying another...`);
+			logger$1.log(`   Port ${candidate} is taken; trying another...`);
 		}
-		if (externalPort === void 0) throw new PostgresPortUnavailable(postgres.appName, [...taken]);
-		logger.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
+		if (externalPort === void 0) throw new PostgresPortUnavailable(cluster.appName, [...taken]);
+		logger$1.log(`   Publishing ${cluster.appName} on ${externalPort}...`);
+	}
+	const port = externalPort;
+	let closed = false;
+	const close = async () => {
+		if (!opened || closed) return;
+		closed = true;
+		await api.savePostgresExternalPort(cluster.postgresId, null).then(() => api.deployPostgres(cluster.postgresId)).catch(() => {
+			logger$1.log(`   ⚠ Could not close external port ${port} on ${cluster.appName} — close it in Dokploy.`);
+		});
+	};
+	try {
+		await api.deployPostgres(cluster.postgresId);
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName);
+	} catch (error) {
+		await close();
+		throw error;
 	}
-	await api.deployPostgres(postgres.postgresId);
-	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
+	return {
+		cluster,
+		host,
+		port,
+		close
+	};
+}
+/**
+* A URL the cluster's containers use — its service name, its internal port —
+* pointed at where `published` answers from here instead.
+*/
+function publishedUrl(url, published) {
+	const parsed = new URL(url);
+	parsed.hostname = published.host;
+	parsed.port = String(published.port);
+	return parsed.toString();
+}
+/**
+* Run the manifest's DDL against a published Dokploy Postgres.
+*
+* The applier is the local target's, so every statement asks whether it is
+* needed first: a redeploy is free, and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclaredStatements(published, statements) {
+	const { cluster, host, port } = published;
 	const client = { async query(database, sql, values) {
 		const connection = new pg.Client({
-			host: serverHostname,
-			port: externalPort,
-			user: postgres.databaseUser,
-			password: postgres.databasePassword,
-			database: database ?? postgres.databaseName,
+			host,
+			port,
+			user: cluster.databaseUser,
+			password: cluster.databasePassword,
+			database: database ?? cluster.databaseName,
 			connectionTimeoutMillis: 15e3
 		});
 		connection.on("error", () => {});
@@ -1994,35 +2022,22 @@ async function applyDeclaredStatements(api, postgres, serverHostname, statements
 			await connection.end();
 		}
 	} };
-	const unpublish = async () => {
-		if (!opened) return;
-		await api.savePostgresExternalPort(postgres.postgresId, null).then(() => api.deployPostgres(postgres.postgresId)).catch(() => {
-			logger.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
-		});
-	};
 	let lastError;
-	try {
-		for (let attempt = 1; attempt <= 3; attempt++) try {
-			return await applyDeclared(client, statements);
-		} catch (error) {
-			lastError = error;
-			if (attempt === 3) break;
-			const message = error instanceof Error ? error.message : String(error);
-			logger.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
-			await new Promise((resolve) => setTimeout(resolve, 1e4));
-			await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName).catch(() => {});
-		}
-		throw lastError;
-	} finally {
-		await unpublish();
+	for (let attempt = 1; attempt <= 3; attempt++) try {
+		return await applyDeclared(client, statements);
+	} catch (error) {
+		lastError = error;
+		if (attempt === 3) break;
+		const message = error instanceof Error ? error.message : String(error);
+		logger$1.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+		await new Promise((resolve) => setTimeout(resolve, 1e4));
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName).catch(() => {});
 	}
+	throw lastError;
 }
-/**
-* Get the server hostname from the Dokploy endpoint URL
-*/
-function getServerHostname(endpoint) {
-	return new URL(endpoint).hostname;
-}
+//#endregion
+//#region src/target/dokploy/engine.ts
+const logger = require_discover.output;
 /**
 * The variables an app cannot start without.
 *
@@ -2050,6 +2065,19 @@ var BackendDeployFailed = class extends Error {
 		this.name = "BackendDeployFailed";
 	}
 };
+/**
+* Sites failed to release or to answer. Every site is attempted before this
+* is thrown, so one broken site does not keep the others back — but the run
+* fails, and what failed is rolled back.
+*/
+var FrontendDeployFailed = class extends Error {
+	apps;
+	constructor(apps, cause) {
+		super(`Frontend deployment failed for ${apps.join(", ")}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.apps = apps;
+		this.name = "FrontendDeployFailed";
+	}
+};
 /** An app's environment needs values the stage does not have. */
 var MissingEnvVars = class extends Error {
 	app;
@@ -2078,6 +2106,16 @@ const CHILD_STDIO = {
 	],
 	ignore: "ignore"
 };
+/** The defaults of `deploy.dokploy.verify`. */
+function verifySettings(config) {
+	return {
+		deploymentTimeoutMs: config?.deploymentTimeoutMs ?? 6e5,
+		healthCheckPath: config?.healthCheckPath ?? "/health",
+		healthyAfter: config?.healthyAfter ?? 3,
+		intervalMs: config?.intervalMs ?? 2e3,
+		healthTimeoutMs: config?.healthTimeoutMs ?? 3e5
+	};
+}
 /**
 * Deploy every app in a workspace to Dokploy: the engine under the built-in
 * `dokploy` target.
@@ -2128,7 +2166,14 @@ async function validateDokploy(phase) {
 	};
 	return {
 		...run,
-		preflight: await preflight(run)
+		preflight: await preflight(run),
+		verify: verifySettings(workspace.deploy.dokploy?.verify),
+		atomic: phase.atomic,
+		releasing: {
+			switched: /* @__PURE__ */ new Map(),
+			failed: /* @__PURE__ */ new Set()
+		},
+		published: /* @__PURE__ */ new Map()
 	};
 }
 /**
@@ -2139,7 +2184,7 @@ async function preflight({ workspace, manifest, stage, secrets: secretsStore, ct
 	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const stored = await secretsStore.read();
 	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
-	const { secrets: stageSecrets, generated } = require_sniffer.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
+	const { secrets: stageSecrets, generated } = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(stage), manifest);
 	if (generated.length > 0) {
 		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		else {
@@ -2166,6 +2211,19 @@ async function preflight({ workspace, manifest, stage, secrets: secretsStore, ct
 * before it is created, so a run stopped part way is finished by the next.
 */
 async function provisionDokploy(run) {
+	try {
+		await provision(run);
+	} catch (error) {
+		await closePublished(run);
+		throw error;
+	}
+}
+/** Unpublish every cluster the run still has published. */
+async function closePublished(run) {
+	for (const published of run.published.values()) await published.close();
+	run.published.clear();
+}
+async function provision(run) {
 	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
 	const { stageSecrets } = run.preflight;
 	const changes = [];
@@ -2179,7 +2237,7 @@ async function provisionDokploy(run) {
 	};
 	const { api, endpoint } = await dokployApi(workspace, ctx);
 	logger.log("\n📋 Loading deploy state...");
-	const journal = await DeployJournal.open(store, stage, () => require_sniffer.createEmptyState(stage, "", ""));
+	const journal = await require_state.DeployJournal.open(store, stage, () => require_state.createEmptyState(stage, "", ""));
 	const state = journal.state;
 	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
 	else logger.log(`   Creating new state for stage "${stage}"`);
@@ -2191,7 +2249,7 @@ async function provisionDokploy(run) {
 		key: "project",
 		type: "project",
 		data: {
-			name: require_store.projectName(identity),
+			name: require_state.projectName(identity),
 			identity: identity.key
 		}
 	};
@@ -2235,7 +2293,7 @@ async function provisionDokploy(run) {
 	state.environmentId = environmentId;
 	state.identity = identity.key;
 	logger.log("\n🐳 Checking registry...");
-	const registry = workspace.deploy.dokploy?.registry;
+	const registry = workspace.deploy.registry;
 	let registryCreated = false;
 	const dokployRegistry = await resolveRegistry(api, {
 		stage,
@@ -2269,6 +2327,7 @@ async function provisionDokploy(run) {
 	if (skippedMobileApps.length > 0) logger.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	let declaredEnv = {};
 	let declaredClusters = {};
+	let migrations = /* @__PURE__ */ new Map();
 	{
 		logger.log("\n📦 Provisioning declared constructs...");
 		const appUrls = {};
@@ -2291,30 +2350,35 @@ async function provisionDokploy(run) {
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
 		if (Object.keys(declaredEnv).length > 0) logger.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
-		if (declared.statements.length > 0) {
-			const serverHostname = getServerHostname(endpoint);
-			for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
-				const statements = declared.statements.filter((statement) => statement.database === databaseName);
-				if (statements.length === 0) continue;
-				const created = await applyDeclaredStatements(api, cluster, serverHostname, statements);
-				logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+		migrations = await migrationUrls(workspace.root, manifest, declaredEnv);
+		const host = serverHostname(endpoint);
+		for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
+			const statements = declared.statements.filter((statement) => statement.database === databaseName);
+			if (statements.length === 0) continue;
+			const published = await publishPostgres(api, cluster, host);
+			run.published.set(databaseName, published);
+			const created = await applyDeclaredStatements(published, statements);
+			if (!migrations.has(databaseName)) {
+				await published.close();
+				run.published.delete(databaseName);
 			}
+			logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
 		}
 	}
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
 		logger.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-BmhIO_Yr.cjs"));
+		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-oDEsPj02.cjs"));
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
 			projectName: identity.scope,
 			stage,
 			config: workspace.deploy.backups,
-			existingState: require_sniffer.getBackupState(state),
+			existingState: require_state.getBackupState(state),
 			logger
 		});
-		require_sniffer.setBackupState(state, backupState);
+		require_state.setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
@@ -2328,7 +2392,7 @@ async function provisionDokploy(run) {
 				enabled: true,
 				keepLatestCount: backupRetention
 			});
-			require_sniffer.setPostgresBackupId(state, backup.backupId);
+			require_state.setPostgresBackupId(state, backup.backupId);
 			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger.log("   ✓ Using existing postgres backup schedule");
 	}
@@ -2342,14 +2406,22 @@ async function provisionDokploy(run) {
 		registry,
 		registryId,
 		declaredEnv,
+		declaredClusters,
+		migrations,
 		changes,
 		applied
 	};
 }
 /**
-* Each app's image built and pushed, its application configured and
-* deployed, and its domain attached: backends first, each failure stopping
-* the run; then sites, whose build args are the backends' public URLs.
+* The stage's migrations, then each app's image built and pushed, its
+* application configured and deployed, and its domain attached — counted as
+* released only once Dokploy's deployment has finished.
+*
+* Backends first, each failure stopping the run; then they are checked, and
+* a backend that does not answer stops the run too — a site built against an
+* API that is down is a site that is down. Then the sites, whose build args
+* are the backends' public URLs: every one is attempted, and any that failed
+* fails the run. `verify` checks the sites.
 *
 * Building is here rather than in a `build` phase of its own because an
 * image is built beside its application — a site's build args are resolved
@@ -2360,12 +2432,25 @@ async function releaseDokploy(run) {
 	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
 	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
 	const project = { projectId: run.provisioned.projectId };
+	try {
+		await migrate(run);
+	} finally {
+		await closePublished(run);
+	}
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const publicUrls = {};
 	const results = [];
 	const appHostnames = /* @__PURE__ */ new Map();
 	const appDomainIds = /* @__PURE__ */ new Map();
+	const released = {
+		results,
+		publicUrls,
+		appHostnames,
+		appDomainIds,
+		applicationIds: /* @__PURE__ */ new Map()
+	};
+	run.released = released;
 	/** An app is up: say so, and remember where. */
 	const deployed = (appName, result, host) => {
 		const url = `https://${host}`;
@@ -2382,29 +2467,8 @@ async function releaseDokploy(run) {
 			url
 		});
 	};
-	/** An app failed: say so, and record it in the result. */
-	const failed = (appName, app, error) => {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
-		results.push({
-			appName,
-			type: app.type,
-			success: false,
-			error: message
-		});
-		ctx.emit({
-			type: "app.failed",
-			app: appName,
-			error: require_terminal.eventError(error)
-		});
-	};
 	/** An image is pushed: worth keeping even if what follows fails. */
-	const built = async (appName, image, ref) => {
-		require_sniffer.setDeployedImage(state, appName, {
-			ref: image.imageRef ?? ref,
-			...image.digest ? { digest: image.digest } : {}
-		});
-		await journal.save();
+	const built = (appName, image, ref) => {
 		ctx.emit({
 			type: "artifact.built",
 			app: appName,
@@ -2418,6 +2482,41 @@ async function releaseDokploy(run) {
 			id: image.digest ?? image.imageRef ?? ref
 		});
 	};
+	/**
+	* Point an app's application at its image and environment, deploy it,
+	* attach its domain, and wait for Dokploy to finish — then record the
+	* release, with what ran before it as the one a rollback restores.
+	*/
+	const release = async (appName, applicationId, image, envVars, host) => {
+		const app = workspace.apps[appName];
+		released.applicationIds.set(appName, applicationId);
+		const since = await api.latestDeploymentAt(applicationId);
+		const before = state.releases?.[appName]?.current;
+		run.releasing.switched.set(appName, {
+			applicationId,
+			...before ? { before } : {}
+		});
+		await api.saveDockerProvider(applicationId, image.ref, { registryId });
+		await api.saveApplicationEnv(applicationId, envVars.join("\n"));
+		logger.log(`      Deploying to Dokploy...`);
+		await api.deployApplication(applicationId);
+		const domainId = await ensureDomain(api, journal, host, app.port, applicationId, applied);
+		appHostnames.set(appName, host);
+		if (domainId) appDomainIds.set(appName, domainId);
+		logger.log(`      Waiting for the deployment to finish...`);
+		await api.waitForDeployment(applicationId, {
+			since,
+			timeoutMs: run.verify.deploymentTimeoutMs,
+			intervalMs: run.verify.intervalMs,
+			signal: ctx.signal
+		});
+		require_state.recordRelease(state, appName, {
+			...image,
+			tag: imageTag
+		});
+		await journal.save();
+		publicUrls[appName] = `https://${host}`;
+	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
 	if (backendApps.length > 0) {
@@ -2427,14 +2526,14 @@ async function releaseDokploy(run) {
 			const app = workspace.apps[appName];
 			logger.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
-				const application = await ensureApplication(api, journal, appName, require_store.applicationName(identity, appName), project.projectId, environmentId, applied);
+				const application = await ensureApplication(api, journal, appName, require_state.applicationName(identity, appName), project.projectId, environmentId, applied);
 				const appSecrets = encryptedSecrets.get(appName);
 				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
 					encrypted: appSecrets.payload.encrypted,
 					iv: appSecrets.payload.iv
 				} : void 0;
 				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
-				const imageRef$1 = require_store.imageRef(identity, appName, registry, imageTag);
+				const imageRef$1 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$1}`);
 				const image = await deployDocker({
 					stage,
@@ -2442,13 +2541,13 @@ async function releaseDokploy(run) {
 					skipPush: false,
 					config: {
 						registry,
-						imageName: require_store.imageName(identity, appName),
+						imageName: require_state.imageName(identity, appName),
 						appName
 					},
 					credentials,
 					...dockerRun(workspace, app, ctx)
 				});
-				await built(appName, image, imageRef$1);
+				built(appName, image, imageRef$1);
 				const backendHost = hostOf(workspace, appName, stage);
 				const dependencyUrls = {};
 				if (app.dependencies) {
@@ -2479,14 +2578,10 @@ async function releaseDokploy(run) {
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
 				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
-				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
-				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger.log(`      Deploying to Dokploy...`);
-				await api.deployApplication(application.applicationId);
-				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId, applied);
-				appHostnames.set(appName, backendHost);
-				if (domainId) appDomainIds.set(appName, domainId);
-				publicUrls[appName] = `https://${backendHost}`;
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, backendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
@@ -2497,11 +2592,20 @@ async function releaseDokploy(run) {
 				logger.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				if (ctx.signal?.aborted) throw ctx.signal.reason;
-				failed(appName, app, error);
+				failed(run, appName, error);
 				throw new BackendDeployFailed(appName, error);
 			}
 		}
+		await settleDns(run, backendApps);
+		for (const appName of backendApps) try {
+			await checkHealth(run, appName);
+		} catch (error) {
+			if (ctx.signal?.aborted) throw ctx.signal.reason;
+			failed(run, appName, error);
+			throw new BackendDeployFailed(appName, error);
+		}
 	}
+	let frontendFailure;
 	if (frontendApps.length > 0) {
 		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
 		for (const appName of frontendApps) {
@@ -2509,7 +2613,7 @@ async function releaseDokploy(run) {
 			const app = workspace.apps[appName];
 			logger.log(`\n   🌐 Deploying ${appName}...`);
 			try {
-				const application = await ensureApplication(api, journal, appName, require_store.applicationName(identity, appName), project.projectId, environmentId, applied);
+				const application = await ensureApplication(api, journal, appName, require_state.applicationName(identity, appName), project.projectId, environmentId, applied);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -2538,7 +2642,7 @@ async function releaseDokploy(run) {
 					}
 				}
 				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
-				const imageRef$2 = require_store.imageRef(identity, appName, registry, imageTag);
+				const imageRef$2 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$2}`);
 				const image = await deployDocker({
 					stage,
@@ -2546,28 +2650,24 @@ async function releaseDokploy(run) {
 					skipPush: false,
 					config: {
 						registry,
-						imageName: require_store.imageName(identity, appName),
+						imageName: require_state.imageName(identity, appName),
 						appName
 					},
 					buildArgs,
 					publicUrlArgs: publicUrlArgNames,
 					...dockerRun(workspace, app, ctx)
 				});
-				await built(appName, image, imageRef$2);
+				built(appName, image, imageRef$2);
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
 					`STAGE=${stage}`
 				];
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
-				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
-				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger.log(`      Deploying to Dokploy...`);
-				await api.deployApplication(application.applicationId);
-				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId, applied);
-				appHostnames.set(appName, frontendHost);
-				if (domainId) appDomainIds.set(appName, domainId);
-				publicUrls[appName] = `https://${frontendHost}`;
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, frontendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
@@ -2578,42 +2678,199 @@ async function releaseDokploy(run) {
 				logger.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				if (ctx.signal?.aborted) throw ctx.signal.reason;
-				failed(appName, app, error);
+				failed(run, appName, error);
+				frontendFailure ??= error;
 			}
 		}
 	}
 	logger.log("\n📋 Saving deploy state...");
 	await journal.save();
 	logger.log("   ✓ State saved");
-	run.released = {
-		results,
-		publicUrls,
-		appHostnames
-	};
+	if (frontendFailure !== void 0) throw new FrontendDeployFailed(frontendApps.filter((app) => run.releasing.failed.has(app)), frontendFailure);
 }
-/** DNS records for each released app, and Dokploy's validation of each domain. */
+/** Each released site answering, after its DNS. Backends were checked in `release`. */
 async function verifyDokploy(run) {
+	const { workspace, ctx } = run;
+	const sites = run.released.results.filter((result) => result.success).map((result) => result.appName).filter((app) => workspace.apps[app]?.type === "web");
+	if (sites.length === 0) return;
+	await settleDns(run, sites);
+	let failure;
+	for (const appName of sites) try {
+		await checkHealth(run, appName);
+	} catch (error) {
+		if (ctx.signal.aborted) throw ctx.signal.reason;
+		failed(run, appName, error);
+		failure ??= error;
+	}
+	if (failure !== void 0) throw new FrontendDeployFailed(sites.filter((app) => run.releasing.failed.has(app)), failure);
+}
+/**
+* An app failed to release or to answer: say so, mark it for rollback, and
+* record it in the result — over the success it was recorded as, if its
+* health is what failed.
+*/
+function failed(run, appName, error) {
+	const app = run.workspace.apps[appName];
+	const message = error instanceof Error ? error.message : "Unknown error";
+	logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+	const results = run.released.results;
+	const recorded = results.find((result) => result.appName === appName);
+	if (recorded) {
+		recorded.success = false;
+		recorded.error = message;
+	} else results.push({
+		appName,
+		type: app.type,
+		success: false,
+		error: message
+	});
+	run.releasing.failed.add(appName);
+	run.ctx.emit({
+		type: "app.failed",
+		app: appName,
+		error: require_sniffer.eventError(error)
+	});
+}
+/**
+* The stage's pending migrations, applied in the deploy's sandbox against
+* each cluster published for them. Nothing is published, and nothing runs,
+* for a project with no migration to apply.
+*/
+async function migrate(run) {
+	const { workspace, manifest, stage, ctx } = run;
+	const { api, endpoint, migrations, declaredClusters } = run.provisioned;
+	if (migrations.size === 0) return;
+	logger.log("\n🗄️  Applying migrations...");
+	const host = serverHostname(endpoint);
+	const urls = {};
+	for (const [database, keys] of migrations) {
+		const cluster = declaredClusters[database];
+		if (!cluster) continue;
+		let published = run.published.get(database);
+		if (!published) {
+			published = await publishPostgres(api, cluster, host);
+			run.published.set(database, published);
+		}
+		for (const [key, url] of Object.entries(keys)) urls[key] = publishedUrl(url, published);
+	}
+	const runs = await runMigrations({
+		root: workspace.root,
+		stage,
+		manifest,
+		patterns: require_state.constructGlobs(workspace),
+		urls,
+		signal: ctx.signal
+	});
+	for (const { migrations: folder, applied } of runs) logger.log(applied.length === 0 ? `   ✓ ${folder}: up to date` : `   ✓ ${folder}: applied ${applied.join(", ")}`);
+}
+/**
+* DNS records for `apps`' hosts, their propagation, and Dokploy's validation
+* of each domain — before anything is asked of them by name.
+*/
+async function settleDns(run, apps) {
 	const { workspace } = run;
 	const { api, endpoint, journal, state } = run.provisioned;
-	const { appHostnames } = run.released;
+	const appHostnames = new Map([...run.released.appHostnames].filter(([app]) => apps.includes(app)));
 	const dnsConfig = workspace.deploy.dns;
-	if (dnsConfig && appHostnames.size > 0) {
-		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
-		if (dnsResult?.serverIp && appHostnames.size > 0) {
-			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
-			await journal.save();
+	if (!dnsConfig || appHostnames.size === 0) return;
+	const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
+	if (dnsResult?.serverIp) {
+		await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
+		await journal.save();
+	}
+	if (dnsResult?.success) {
+		logger.log("\n🔒 Validating domains for SSL certificates...");
+		for (const [appName, hostname] of appHostnames) try {
+			const result = await api.validateDomain(hostname);
+			if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+			else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
+		} catch (validationError) {
+			const message = validationError instanceof Error ? validationError.message : "Unknown error";
+			logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
 		}
-		if (dnsResult?.success && appHostnames.size > 0) {
-			logger.log("\n🔒 Validating domains for SSL certificates...");
-			for (const [appName, hostname] of appHostnames) try {
-				const result = await api.validateDomain(hostname);
-				if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
-				else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
-			} catch (validationError) {
-				const message = validationError instanceof Error ? validationError.message : "Unknown error";
-				logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
-			}
+	}
+}
+/**
+* Whether a released app answers: `healthyAfter` 2xx in a row from its
+* health route under its domain. An app without a domain has nothing to ask
+* by name, so Dokploy's finished deployment is its check.
+*/
+async function checkHealth(run, appName) {
+	const { workspace, verify, ctx } = run;
+	const { appHostnames, appDomainIds, applicationIds } = run.released;
+	const host = appHostnames.get(appName);
+	if (!host || !appDomainIds.has(appName)) {
+		ctx.emit({
+			type: "health.checked",
+			app: appName,
+			url: `dokploy:application.status/${applicationIds.get(appName)}`,
+			healthy: true,
+			attempt: 1
+		});
+		logger.log(`   ✓ ${appName}: no domain, so its finished deployment is its check`);
+		return;
+	}
+	const url = `https://${host}${workspace.apps[appName].type === "web" ? "/" : verify.healthCheckPath}`;
+	logger.log(`\n🩺 Checking ${appName} at ${url}...`);
+	await verifyHealth({
+		app: appName,
+		url,
+		healthyAfter: verify.healthyAfter,
+		intervalMs: verify.intervalMs,
+		timeoutMs: verify.healthTimeoutMs,
+		signal: ctx.signal,
+		emit: ctx.emit
+	});
+	logger.log(`   ✓ ${appName} healthy (${verify.healthyAfter} in a row)`);
+}
+/**
+* Point an application back at `image`, deploy it, and wait for Dokploy to
+* finish. The environment stays the newer release's: it is resolved from the
+* stage, which a rollback does not change, and holds no image of its own.
+*/
+async function restoreImage(api, options) {
+	const { applicationId, image, registryId, verify, signal } = options;
+	const since = await api.latestDeploymentAt(applicationId);
+	await api.saveDockerProvider(applicationId, image.ref, registryId ? { registryId } : void 0);
+	await api.deployApplication(applicationId);
+	await api.waitForDeployment(applicationId, {
+		since,
+		timeoutMs: verify.deploymentTimeoutMs,
+		intervalMs: verify.intervalMs,
+		signal
+	});
+}
+/**
+* Put back what ran before this run, after its `release` or `verify` failed:
+* the apps that failed — or, `atomic`, every app the run released — each
+* pointed at its previous image and redeployed. An app released for the
+* first time has nothing to go back to and is left as it is.
+*/
+async function rollbackDokploy(run, failure) {
+	const { switched, failed: failedApps } = run.releasing;
+	const apps = [...switched.keys()].filter((app) => run.atomic || failedApps.has(app));
+	if (!run.provisioned || apps.length === 0) {
+		logger.log(`\n⏪ Nothing to roll back: the ${failure.phase} failed before any app was switched.`);
+		return;
+	}
+	const { api, journal, state, registryId } = run.provisioned;
+	logger.log(`\n⏪ Rolling back ${run.atomic ? "every app this run released" : "what failed"}: ${apps.join(", ")}`);
+	for (const appName of apps) {
+		const { applicationId, before } = switched.get(appName);
+		if (!before) {
+			logger.log(`   ⚠ ${appName}: this was its first release, so there is nothing to restore`);
+			continue;
 		}
+		await restoreImage(api, {
+			applicationId,
+			image: before,
+			registryId,
+			verify: run.verify,
+			signal: run.ctx.signal
+		});
+		require_state.recordRollback(state, appName, before);
+		await journal.save();
+		logger.log(`   ✓ ${appName} rolled back to ${before.ref}`);
 	}
 }
 /** What the run did, printed as the summary it always ended with. */
@@ -2680,7 +2937,7 @@ async function ensureApplication(api, journal, appName, dokployAppName, projectI
 		action: via === "created" ? "create" : "reuse",
 		id: resource.applicationId
 	}, via);
-	require_sniffer.setApplicationId(journal.state, appName, resource.applicationId);
+	require_state.setApplicationId(journal.state, appName, resource.applicationId);
 	return resource;
 }
 /**
@@ -2730,10 +2987,14 @@ async function ensureDomain(api, journal, host, port, applicationId, applied) {
 function isAbort(error) {
 	return error instanceof Error && error.name === "AbortError";
 }
-/** Where docker runs for one app: in the app's own directory. */
+/**
+* Where docker runs for one app: the workspace root, building from the
+* Dockerfile `gkm docker` writes for the app there.
+*/
 function dockerRun(workspace, app, ctx) {
 	return {
-		cwd: (0, node_path.resolve)(workspace.root, app.path),
+		cwd: workspace.root,
+		appPath: app.path,
 		...ctx.signal ? { signal: ctx.signal } : {},
 		...ctx.stdio ? { stdio: ctx.stdio } : {}
 	};
@@ -2758,7 +3019,7 @@ async function dokployApi(workspace, ctx) {
 /** Each app's public host, the same way the deploy resolves it. */
 function hostOf(workspace, appName, stage) {
 	const app = workspace.apps[appName];
-	return require_sniffer.resolveHost(appName, app, stage, workspace.deploy?.domains, app.type === "web" && require_sniffer.isMainFrontendApp(appName, app, workspace.apps));
+	return require_state.resolveHost(appName, app, stage, workspace.deploy?.domains, app.type === "web" && require_state.isMainFrontendApp(appName, app, workspace.apps));
 }
 /**
 * What a deploy would do, from the same lookups it starts with — and nothing
@@ -2792,7 +3053,7 @@ async function planDokploy(run) {
 		key: "project",
 		resourceType: "project",
 		action: "create"
-	}, require_store.projectName(identity));
+	}, require_state.projectName(identity));
 	const environment = project?.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 	plan(environment ? {
 		key: "environment",
@@ -2807,7 +3068,7 @@ async function planDokploy(run) {
 	let registryPlanned;
 	const registry = await resolveRegistry(api, {
 		stage,
-		registry: workspace.deploy.dokploy?.registry,
+		registry: workspace.deploy.registry,
 		configuredId: workspace.deploy.dokploy?.registryId,
 		stateId: state?.registryId,
 		log: (message) => logger.log(message),
@@ -2839,7 +3100,7 @@ async function planDokploy(run) {
 	for (const appName of appsToDeployNames) {
 		const app = workspace.apps[appName];
 		if (app.type === "mobile") continue;
-		const dokployAppName = require_store.applicationName(identity, appName);
+		const dokployAppName = require_state.applicationName(identity, appName);
 		const recordedId = state?.applications?.[appName];
 		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
 		plan(existing ? {
@@ -2852,7 +3113,7 @@ async function planDokploy(run) {
 			resourceType: "application",
 			action: "create"
 		}, dokployAppName);
-		const ref = require_store.imageRef(identity, appName, workspace.deploy.dokploy?.registry, imageTag);
+		const ref = require_state.imageRef(identity, appName, workspace.deploy.registry, imageTag);
 		plan({
 			key: `image:${appName}`,
 			resourceType: "image",
@@ -2906,6 +3167,24 @@ Object.defineProperty(exports, "BackendDeployFailed", {
 		return BackendDeployFailed;
 	}
 });
+Object.defineProperty(exports, "DeployMigrationsFailed", {
+	enumerable: true,
+	get: function() {
+		return DeployMigrationsFailed;
+	}
+});
+Object.defineProperty(exports, "FrontendDeployFailed", {
+	enumerable: true,
+	get: function() {
+		return FrontendDeployFailed;
+	}
+});
+Object.defineProperty(exports, "HealthCheckTimedOut", {
+	enumerable: true,
+	get: function() {
+		return HealthCheckTimedOut;
+	}
+});
 Object.defineProperty(exports, "MissingEnvVars", {
 	enumerable: true,
 	get: function() {
@@ -2936,6 +3215,12 @@ Object.defineProperty(exports, "RegistryNotFound", {
 		return RegistryNotFound;
 	}
 });
+Object.defineProperty(exports, "dokployApi", {
+	enumerable: true,
+	get: function() {
+		return dokployApi;
+	}
+});
 Object.defineProperty(exports, "dokployResult", {
 	enumerable: true,
 	get: function() {
@@ -2960,6 +3245,18 @@ Object.defineProperty(exports, "releaseDokploy", {
 		return releaseDokploy;
 	}
 });
+Object.defineProperty(exports, "restoreImage", {
+	enumerable: true,
+	get: function() {
+		return restoreImage;
+	}
+});
+Object.defineProperty(exports, "rollbackDokploy", {
+	enumerable: true,
+	get: function() {
+		return rollbackDokploy;
+	}
+});
 Object.defineProperty(exports, "validateDokploy", {
 	enumerable: true,
 	get: function() {
@@ -2972,5 +3269,11 @@ Object.defineProperty(exports, "verifyDokploy", {
 		return verifyDokploy;
 	}
 });
+Object.defineProperty(exports, "verifySettings", {
+	enumerable: true,
+	get: function() {
+		return verifySettings;
+	}
+});
 
-//# sourceMappingURL=deploy-55rJkdKz.cjs.map
+//# sourceMappingURL=engine-DR6KurWX.cjs.map