@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.66

package/dist/{deploy-CZ5nlpsu.mjs → engine-CunvOG3s.mjs}

@@ -1,1770 +1,1900 @@
-import { S as keyFingerprint, b as encryptSecrets, f as StateStoreBusy, i as DokployApiError, m as StateVersionConflict, r as DokployApi, t as sniffAllApps, v as eventError } from "./sniffer-BZ-OJO4Y.mjs";
-import { c as runOutput, s as run } from "./local-CWR4Y_kW.mjs";
+import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
 import { t as MissingCredential } from "./credentials-Dq1MnWQf.mjs";
-import { d as output, r as discover } from "./discover-LMrqsWSU.mjs";
+import { a as discriminatedUnion, d as string, l as object, n as array, o as literal, s as looseObject } from "./schemas-Cfhtpdo0.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-BFoJWKGD.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-C06_pW4g.mjs";
-import "./config.mjs";
-import { i as toEmbeddableSecrets, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, p as isOwnedBy } from "./store-CLiHnqOY.mjs";
-import { C as isMainFrontendApp, D as constructGlobs, J as providerOf, K as cacheBackendFor, N as applyPostgres, S as validateImageRef, W as resourceName, Y as storageBackendFor, _ as dockerCommand, a as setApplicationId, c as setDnsRecord, d as setPostgresBackupId, f as DeployJournal, h as DockerPushFailed, i as isDnsVerified, l as setDnsVerification, m as DockerBuildFailed, n as getBackupState, o as setBackupState, p as withGeneratedSecrets, q as eventsBackendFor, r as getGeneratedSecret, s as setDeployedImage, t as createEmptyState, u as setGeneratedSecret, w as resolveHost } from "./state-B8YwmUZU.mjs";
-import "./terminal-CfbiYUbZ.mjs";
-import { join, resolve } from "node:path";
+import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-Be6uBhlF.mjs";
+import { C as validateImageRef, Ct as markerOf, Et as initStageSecrets, J as cacheBackendFor, K as resourceName, O as constructGlobs, P as applyPostgres, St as isOwnedBy, T as resolveHost, Tt as projectName, V as dockerfileOf, X as providerOf, Y as eventsBackendFor, Z as storageBackendFor, a as recordRelease, bt as imageName, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, g as DockerPushFailed, h as DockerBuildFailed, i as isDnsVerified, kt as toEmbeddableSecrets, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, o as recordRollback, p as DeployJournal, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, u as setDnsVerification, v as dockerCommand, vt as applicationName, w as isMainFrontendApp, wt as ownershipMarker, xt as imageRef } from "./state-uuYqnRVO.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError, x as keyFingerprint, y as encryptSecrets } from "./sniffer-BAQhLEsI.mjs";
+import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
+import { join } from "node:path";
 import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
+import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
-//#region src/deploy/fromManifest.ts
+//#region src/deploy/docker.ts
+const logger$3 = output;
 /**
-* The Dokploy target, read off the construct manifest.
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
 *
-* The AWS target has done this since `fromManifest` landed: a table keyed by
-* declaration kind, each entry turning one declaration into infrastructure and
-* the env keys it resolves. Dokploy had no such thing — it resolved environment
-* from the *sniffer*, which walks application code for `get('X')` calls, and a
-* construct reads its own key inside `@geekmidas/constructs` where there is
-* nothing to find. So a declared app deployed here got none of the model, and
-* nothing reported the absence: the deploy succeeded and the first request that
-* needed a URL failed at runtime.
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
 *
-* This is the same table, over the REST wrapper instead of over Pulumi.
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
 *
-* **Two phases, and the split is not incidental.** Creating a Postgres and
-* creating a role inside it are different kinds of act: the first is an API
-* call, the second needs a connection to a database that does not exist yet
-* when the call is made. So provisioners *accumulate* DDL rather than running
-* it, and it is applied once against a cluster that is up — which is exactly
-* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
 *
-* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
-* the same generators the local target and the AWS target use. Dokploy used to
-* write its own `DO $$` block, which meant three targets applying three
-* different definitions of "the role split" and no way to notice they had
-* drifted.
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
+	const path = join(dir, CREDENTIALS_SECRET_ID);
+	await writeFile(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
+	await chmod(path, 384);
+	return {
+		path,
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
+	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$3.log("   Generating Dockerfile...");
+	await dockerCommand({
+		slim: true,
+		cwd
+	});
+	const dockerfilePath = dockerfile;
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs,
+			credentialsFile: secret?.path
+		}), {
+			cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
 *
-* Entries are deliberately small and free of I/O ordering: each takes what it
-* needs and returns what it resolved. That is what would let a Pulumi dynamic
-* provider wrap one later without the table itself changing — see §6b.
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
 */
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
 /**
-* The internal hostname a Dokploy Postgres answers on.
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: join(cwd, dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$3.log("\n✅ Docker deployment ready!");
+	logger$3.log(`\n📋 Deployment details:`);
+	logger$3.log(`   Image: ${imageRef}`);
+	logger$3.log(`   Stage: ${stage}`);
+	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
+//#region src/deploy/ownership.ts
+/**
+* Which Dokploy project a deploy is allowed to deploy into.
 *
-* Its own service name on the Docker network — not the server's public address.
-* An app reaching its database over the public internet would be a credential
-* crossing a network that did not need to see it.
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
 */
-function clusterHost(postgres) {
-	return postgres.appName;
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
 }
 /**
-* What a resource is called in the provider.
+* The project this identity owns, if there is one — read only, so a dry run
+* asks the same question a deploy does:
 *
-* `cloudName` and nothing else — the same scoped kebab rule the AWS target
-* uses, so a name reads identically on both: `production-shop-orders`.
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project.
+* 2. One with this name *and* this identity's marker.
 *
-* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
-* is one flat list where an application and its database would collide. It is
-* not: `project.one` returns typed collections — `applications`, `postgres`,
-* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
-* the shape of the response and an application and a Postgres of the same name
-* are different objects with different ids. The suffix was answering a question
-* nobody had asked.
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
 */
-function serviceName(scope, id) {
-	return cloudName(scope, id);
-}
-const PROVISIONERS = {
-	/**
-	* A Postgres service, plus the roles that reach it.
-	*
-	* The service is `findOrCreate`, because a deploy that recreated the
-	* database would be a deploy that lost the data. The roles are deferred:
-	* they need a connection to a cluster this call has only just asked for.
-	*/
-	database: async (declaration, context) => {
-		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
-		const name = resourceName(declaration.id, declaration.kind, context.stage);
-		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
-			stage: context.stage,
-			app: context.scope ?? context.project
-		}, declaration.id), context.projectId, context.environmentId, {
-			databaseName: name,
-			databasePassword: derivedPassword(context, `${name}:master`)
-		});
-		const host = clusterHost(postgres);
-		context.clusters[postgres.databaseName] = postgres;
-		const schema = declaration.schema ?? "app";
-		const runtime = name;
-		const owner = ownerRole(runtime);
-		const reads = readsFrom(context.manifest, declaration.id);
-		context.deferred.push(...statementsFor({
-			id: declaration.id,
-			database: postgres.databaseName,
-			ownsDatabase: true,
-			runtime,
-			owner,
-			...reads ? { reader: readerRole(runtime) } : {},
-			schema,
-			context
-		}));
-		return { provides: {
-			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
-			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
-		} };
-	},
-	/**
-	* A schema in the parent's database, with its own role and its own URL — so
-	* the parent's role holds no grant on these tables at all.
-	*/
-	"database-schema": async (declaration, context) => {
-		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
-		const parent = context.provisioned[declaration.of];
-		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const runtime = resourceName(declaration.id, declaration.kind, context.stage);
-		const owner = ownerRole(runtime);
-		const reads = readsFrom(context.manifest, declaration.id);
-		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
-		context.deferred.push(...statementsFor({
-			id: declaration.id,
-			database: parentUrl.pathname.slice(1),
-			runtime,
-			owner,
-			...reads ? { reader: readerRole(runtime) } : {},
-			schema: declaration.schema,
-			context
-		}));
-		return { provides: {
-			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
-			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
-		} };
-	},
-	/**
-	* A read-only endpoint on the same cluster.
-	*
-	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
-	* resolves to the writer's address — and that is safe rather than a
-	* loophole, because read-only is enforced by the reader role's grants and
-	* not by which host the URL names. The role itself was created with its
-	* parent.
-	*/
-	"database-reader": async (declaration, context) => {
-		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
-		const parent = context.provisioned[declaration.of];
-		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
-		const reader = readerRole(parentUrl.username);
-		return { provides: { [provideKey(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
-	},
-	/**
-	* A cache, wherever the project said it lives.
-	*
-	* `db` is a table in a database the manifest already declares, so it
-	* provisions no service and costs nothing to run — the same relationship
-	* pg-boss has. The table's DDL is deferred with the roles, and the table
-	* name travels in the URL because two caches in one database resolve the
-	* same connection string.
-	*/
-	cache: async (declaration, context) => {
-		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
-		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
-		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
-		const parent = context.provisioned[parentId];
-		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
-		const parentUrl = parent.provides[provideKey(parentId, "url")];
-		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
-		const table = declaration.table ?? cacheTable(declaration.id);
-		const schema = schemaOf(context.manifest, parentId);
-		const qualified = schema ? `${schema}.${table}` : table;
-		context.deferred.push(...cacheTableStatements({ table: qualified }).map((statement) => ({
-			id: declaration.id,
-			database: new URL(parentUrl).pathname.slice(1),
-			describe: statement.describe,
-			sql: statement.sql,
-			...statement.exists ? { exists: statement.exists } : {}
-		})), {
-			id: declaration.id,
-			database: new URL(parentUrl).pathname.slice(1),
-			describe: `${qualified} is owned by its schema's owner`,
-			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted(ownerRole(new URL(parentUrl).username))}`
-		}, {
-			id: declaration.id,
-			database: new URL(parentUrl).pathname.slice(1),
-			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
-			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
-		});
-		const url = new URL(parentUrl);
-		url.searchParams.set("table", table);
-		return { provides: { [provideKey(declaration.id, "url")]: url.toString() } };
-	},
-	/**
-	* A bucket, as a MinIO stack on the box.
-	*
-	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* object storage, so this is the one kind whose infrastructure this target
-	* *writes* rather than configures — a compose file with one service in it.
-	*
-	* The service is named `cloudName(...)` like everything else, which is not
-	* cosmetic here: containers on `dokploy-network` resolve each other by
-	* service name, so the name is the address. Calling it `minio` would work
-	* for exactly one project on the box and then collide.
-	*
-	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
-	* reads them from an execution role, so a URL that embedded a key would be
-	* one more thing to rotate and leak. There is no role here, so the same
-	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
-	* locally.
-	*/
-	objects: async (declaration, context) => {
-		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
-		const backend = context.storage ?? "minio";
-		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
-		const service = serviceName({
-			stage: context.stage,
-			app: context.scope ?? context.project
-		}, declaration.id);
-		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
-		const user = `${bucket}-root`;
-		const password = derivedPassword(context, `objects:${declaration.id}`);
-		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
-			service,
-			bucket,
-			user,
-			password
-		}));
-		await context.api.deployCompose(compose.composeId);
-		return { provides: {
-			[provideKey(declaration.id, "url")]: s3Url(service, bucket),
-			AWS_ACCESS_KEY_ID: user,
-			AWS_SECRET_ACCESS_KEY: password,
-			AWS_REGION: MINIO_REGION
-		} };
-	},
-	/**
-	* The address a bucket's objects are served on.
-	*
-	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
-	* behind the first would terminate TLS twice — which is why the local
-	* target's Caddy has no equivalent here. What this resolves is the address,
-	* and the `open` prefixes are applied to the bucket rather than to an edge,
-	* so a policy is what makes them public wherever the bucket lives.
-	*
-	* Until a Traefik rule exists it answers on MinIO directly, path-style,
-	* which is honest about the shape it has today: the bucket is in the path
-	* rather than fronted by a host of its own.
-	*/
-	"file-server": async (declaration, context) => {
-		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
-		const parentUrl = context.provisioned[declaration.of]?.provides[provideKey(declaration.of, "url")];
-		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
-		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
-		const bucket = new URL(parentUrl).hostname;
-		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
-		return { provides: { [provideKey(declaration.id, "url")]: `${endpoint}/${bucket}` } };
-	},
-	/**
-	* A topic, and below it a queue — the same broker either way.
-	*
-	* Under pg-boss there is nothing to create in Dokploy: the broker is a
-	* schema tenant of the database the app already declared, exactly as it is
-	* locally, so what this resolves is an address rather than a service. Which
-	* is the point of putting the backend in config — the same handlers drain
-	* pg-boss here and SQS on AWS because the string they were handed said so.
-	*
-	* The tenant gets its own role rather than the cluster master, for the
-	* reason every other tenant does: pg-boss creates and owns its tables, and
-	* a broker that could also read the application's is a broker with a grant
-	* nothing asked for.
-	*/
-	topic: async (declaration, context) => {
-		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
-		return broker(declaration.id, context);
-	},
-	queue: async (declaration, context) => {
-		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
-		return broker(declaration.id, context);
-	},
-	/**
-	* A signing key, generated once and remembered in the stage's store.
-	*
-	* Random, never derived: a key computed from the project and stage names
-	* signs sessions anyone reading the repo could forge. The deploy generates
-	* it before provisioning (`withGeneratedSecrets`) and every later deploy
-	* reads the same one, so live sessions survive a redeploy. Nothing is
-	* created in Dokploy: a secret has no address.
-	*/
-	secret: async (declaration, context) => {
-		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
-		const key = declaration.provides?.[0];
-		if (!key) return { provides: {} };
-		return { provides: { [key]: supplied(declaration.id, key, context) } };
-	},
-	/**
-	* The keyring the stage keeps in its secrets.
-	*
-	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
-	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
-	* written becomes unreadable. Nothing is created in Dokploy: the process
-	* holds the keyring.
-	*/
-	encryption: async (declaration, context) => {
-		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
-		const key = provideKey(declaration.id, "url");
-		return { provides: { [key]: supplied(declaration.id, key, context) } };
-	},
-	/**
-	* A third party's credentials, as the stage was given them.
-	*
-	* Nothing is created and nothing derived: the value was issued by somebody
-	* else. A stage that was never given one fails the deploy here, naming the
-	* command that sets it — not the first request that needs it.
-	*/
-	credential: async (declaration, context) => {
-		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
-		const key = provideKey(declaration.id, "credentials");
-		return { provides: { [key]: supplied(declaration.id, key, context) } };
-	},
-	/**
-	* An API somebody else runs: the URL this stage calls it at, and the
-	* credentials it was issued for this stage.
-	*/
-	"external-api": async (declaration, context) => {
-		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
-		const credentials = provideKey(declaration.id, "credentials");
-		return { provides: {
-			[provideKey(declaration.id, "url")]: externalApiUrl(declaration, context.stage),
-			[credentials]: supplied(declaration.id, credentials, context)
-		} };
-	},
-	/**
-	* A surface, at the address whatever created its domain assigned.
-	*
-	* Nothing is provisioned here: the application and its domain are the
-	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
-	* Encrypt certificate. What this adds is the *derivation* — who may call it,
-	* and where a cookie it sets is readable — from the graph rather than from a
-	* hand-maintained list.
-	*/
-	"rest-api": async (declaration, context) => {
-		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
-		const url = context.addresses?.[declaration.id];
-		if (!url) throw new SurfaceHasNoAddress(declaration.id);
-		const origins = [...new Set(dependentsOf(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
-		const domain = cookieDomain([url, ...origins]);
-		const schemes = dependentsOf(context.manifest, declaration.id).flatMap((caller) => {
-			const app = context.manifest[caller];
-			return app?.kind === "mobile-app" ? mobileOrigins(schemeBase(context.project, app.scheme)) : [];
-		});
-		return { provides: {
-			[provideKey(declaration.id, "url")]: url,
-			[provideKey(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
-			...domain ? { [provideKey(declaration.id, "cookieDomain")]: domain } : {}
-		} };
-	}
-};
-/** The provisioner for a kind, or nothing where this target has none yet. */
-function provisionerFor(kind) {
-	return PROVISIONERS[kind];
-}
-/**
-* The role DDL for one database or tenant, from the shared generator.
-*
-* The same statements the local target applies and the same ones the AWS
-* bootstrap runs. Dokploy used to write its own, which is how three targets
-* came to hold three definitions of the same split.
-*/
-function statementsFor(options) {
-	const { id, database, runtime, owner, reader, schema, context } = options;
-	return roleStatements({
-		runtime,
-		owner,
-		...reader ? { reader } : {},
-		schema,
-		...options.ownsDatabase ? { database } : {},
-		passwords: {
-			runtime: derivedPassword(context, runtime),
-			owner: derivedPassword(context, owner),
-			...reader ? { reader: derivedPassword(context, reader) } : {}
-		}
-	}).map((statement) => ({
-		...statement,
-		id,
-		database
-	}));
-}
-/**
-* The connection string a declared queue or topic publishes on.
-*
-* One broker for the whole project, which is what the local target does and
-* what the runtime expects: the generated pollers open a single connection and
-* subscribe each worker by name on it. So every carrier resolves to the same
-* address, and the DDL that backs it is pushed once however many are declared.
-*
-* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
-* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
-* the §4.3 question, and composing a plausible URL for either would fail at the
-* first publish instead of here.
-*/
-function broker(id, context) {
-	const backend = context.events ?? "pgboss";
-	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
-	const parentId = soleDatabase(context);
-	if (!parentId) throw new BrokerNeedsADatabase(id);
-	const parentUrl = context.provisioned[parentId]?.provides[provideKey(parentId, "url")];
-	if (!parentUrl) throw new UnresolvedParent(id, parentId);
-	const url = new URL(parentUrl);
-	const database = url.pathname.slice(1);
-	const runtime = `${database}_${PGBOSS_SCHEMA}`;
-	const owner = ownerRole(runtime);
-	if (!context.provisioned[BROKER_ID]) {
-		context.deferred.push(...statementsFor({
-			id: BROKER_ID,
-			database,
-			runtime,
-			owner,
-			schema: PGBOSS_SCHEMA,
-			context
-		}));
-		context.provisioned[BROKER_ID] = { provides: {} };
-	}
-	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
-	return { provides: { [provideKey(id, "publisherConnectionString")]: connection } };
-}
-/** The schema pg-boss creates its tables in, here as locally. */
-const PGBOSS_SCHEMA = "pgboss";
-/**
-* The id the broker's DDL is pushed under.
-*
-* Not a construct — no declaration names it — but the deferred statements need
-* an id, and every carrier in the project shares this one.
-*/
-const BROKER_ID = "PgBoss";
-/**
-* A pg-boss address: a Postgres URL under a scheme that picks the transport.
-*
-* The protocol is what a producer branches on, so it never branches — the same
-* `.publish()` reaches pg-boss here and SQS on AWS.
-*/
-function pgbossUrl(role, password, host, database) {
-	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
-}
-/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
-const MINIO_REGION = "us-east-1";
-/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
-function s3Url(service, bucket) {
-	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
-}
-/**
-* A one-service compose file for a bucket.
-*
-* `dokploy-network` is external and already exists — it is what every Dokploy
-* service is attached to, and joining it is what makes the app able to resolve
-* this one by name. The bucket itself is created by MinIO's entrypoint rather
-* than by a second call, so there is nothing to reconcile afterwards.
-*/
-function minioCompose(options) {
-	const { service, bucket, user, password } = options;
-	return [
-		"services:",
-		`  ${service}:`,
-		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
-		`    command: server /data --console-address ":9001"`,
-		"    environment:",
-		`      MINIO_ROOT_USER: ${user}`,
-		`      MINIO_ROOT_PASSWORD: ${password}`,
-		"    volumes:",
-		`      - ${service}-data:/data`,
-		"    networks:",
-		"      - dokploy-network",
-		"    healthcheck:",
-		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
-		"      interval: 10s",
-		"      retries: 5",
-		`  ${service}-bucket:`,
-		"    image: minio/mc:latest",
-		"    depends_on:",
-		`      ${service}:`,
-		"        condition: service_healthy",
-		"    entrypoint: >",
-		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
-		`      mc mb --ignore-existing s3/${bucket}"`,
-		"    networks:",
-		"      - dokploy-network",
-		"volumes:",
-		`  ${service}-data:`,
-		"networks:",
-		"  dokploy-network:",
-		"    external: true",
-		""
-	].join("\n");
-}
-/** Whether anything reads through a reader on this construct. */
-function readsFrom(manifest, id) {
-	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
-}
-/** The schema a database or tenant pins on its roles. */
-function schemaOf(manifest, id) {
-	const declaration = manifest[id];
-	if (declaration?.kind === "database") return declaration.schema ?? "app";
-	if (declaration?.kind === "database-schema") return declaration.schema;
-}
-/**
-* The one declared database, where `cache: 'db'` has to pick.
-*
-* Unambiguous with one and arbitrary with two, so two is an error rather than a
-* coin toss — a cache landing in a database nobody chose surfaces as entries
-* that are never found, long after the deploy reported success.
-*/
-function soleDatabase(context) {
-	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
-	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
-	return databases[0];
+async function findProject(api, identity, stateProjectId) {
+	const name = projectName(identity);
+	const marker = ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				description: known.description ?? null,
+				environments: known.environments ?? [],
+				via: "state",
+				needsClaim: !claimed
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			description: owned.description ?? null,
+			environments: details.environments ?? [],
+			via: "marker",
+			needsClaim: false
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	return null;
 }
 /**
-* A password derived from the stage's seed, the project, the stage and the role.
-*
-* Derived rather than stored per role so a redeploy hands the running
-* application the password it already has, and two projects never share one.
-* The seed is what makes it secret: random, generated once and kept in the
-* stage's store. Without it the inputs are all in the repo, and so was every
-* production password.
+* The project this deploy deploys into: the one {@link findProject} finds —
+* claimed with this identity's marker if it carries none yet, so the next
+* deploy without state still finds it — or a new one, marked.
 */
-function derivedPassword(context, role) {
-	return createHash("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
-}
-/** A connection string for a role on a cluster. */
-function postgresUrl(role, password, host, database) {
-	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
-}
-/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
-function quoted(name) {
-	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const marker = ownershipMarker(identity);
+	const found = await findProject(api, identity, stateProjectId);
+	if (found) {
+		if (found.needsClaim) {
+			await api.updateProject(found.projectId, {
+				name: found.name,
+				description: withMarker(found.description, marker)
+			});
+			log(`   Claimed project ${found.name} for ${identity.key}`);
+		}
+		return {
+			projectId: found.projectId,
+			name: found.name,
+			environments: found.environments,
+			via: found.via
+		};
+	}
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(projectName(identity), withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
 }
-/** A provisioner was handed a declaration of the wrong kind. */
+//#endregion
+//#region src/deploy/registry.ts
 /**
-* A value only the stage's own secrets can hold.
+* Which Dokploy registry a stage's images are pulled through.
 *
-* @throws {MissingSuppliedSecret} when the stage was never given it.
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
 */
-function supplied(id, key, context) {
-	const value = context.supplied?.[key];
-	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
-	return value;
-}
-/** A construct needs a value the stage was never given. */
-var MissingSuppliedSecret = class extends Error {
-	id;
-	key;
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
 	stage;
-	constructor(id, key, stage) {
-		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
-		this.id = id;
-		this.key = key;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
 		this.stage = stage;
-		this.name = "MissingSuppliedSecret";
-	}
-};
-var WrongKind = class extends Error {
-	kind;
-	constructor(kind) {
-		super(`No Dokploy provisioner handles '${kind}'`);
-		this.kind = kind;
-		this.name = "WrongKind";
-	}
-};
-/** A derived construct whose parent has not been provisioned. */
-var UnresolvedParent = class extends Error {
-	id;
-	parent;
-	constructor(id, parent) {
-		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
-		this.id = id;
-		this.parent = parent;
-		this.name = "UnresolvedParent";
-	}
-};
-/** A cache with nowhere to live. */
-var CacheNeedsAHome = class extends Error {
-	id;
-	backend;
-	constructor(id, backend) {
-		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
-		this.id = id;
-		this.backend = backend;
-		this.name = "CacheNeedsAHome";
-	}
-};
-/** A `'db'` cache (a server target's default) with more than one database. */
-var CacheIsAmbiguous = class extends Error {
-	databases;
-	constructor(databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
-		this.databases = databases;
-		this.name = "CacheIsAmbiguous";
+		this.name = "RegistryNotConfigured";
 	}
 };
-/** A surface reached provisioning before its domain existed. */
-var SurfaceHasNoAddress = class extends Error {
-	id;
-	constructor(id) {
-		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
-		this.id = id;
-		this.name = "SurfaceHasNoAddress";
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
 	}
 };
-/** A queue or topic on a backend this target has no primitive for. */
-var UnprovisionableCarrier = class extends Error {
-	id;
-	backend;
-	constructor(id, backend) {
-		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
-		this.id = id;
-		this.backend = backend;
-		this.name = "UnprovisionableCarrier";
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
 	}
 };
-/** A pg-boss carrier in an app that declares no database to host it. */
-var BrokerNeedsADatabase = class extends Error {
-	id;
-	constructor(id) {
-		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
-		this.id = id;
-		this.name = "BrokerNeedsADatabase";
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
 	}
-};
-/** A bucket on a backend this target has no primitive for. */
-var UnprovisionableBucket = class extends Error {
-	id;
-	backend;
-	constructor(id, backend) {
-		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
-		this.id = id;
-		this.backend = backend;
-		this.name = "UnprovisionableBucket";
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
 	}
-};
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
 //#endregion
-//#region src/deploy/declared.ts
+//#region src/deploy/secrets.ts
 /**
-* The declared half of a Dokploy deploy.
-*
-* `fromManifest.ts` decides what each construct resolves to; this runs it —
-* discovers the manifest, walks it parents-first, and applies the DDL the
-* provisioners deferred.
+* Filter secrets to only include the env vars that an app requires.
 *
-* It is deliberately separate from the engine in `index.ts`. That file deploys
-* *applications*: images, registries, domains, the things a project has whether
-* or not it declares anything. This is the part that exists because the app
-* declared it, and keeping the two apart is what lets a project adopt the model
-* without rewriting its deploy — and lets this one be tested without one.
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Filtered secrets with found/missing tracking
 */
+function filterSecretsForApp(stageSecrets, sniffedEnv) {
+	const allSecrets = toEmbeddableSecrets(stageSecrets);
+	const filtered = {};
+	const found = [];
+	const missing = [];
+	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
+		filtered[key] = allSecrets[key];
+		found.push(key);
+	} else missing.push(key);
+	return {
+		appName: sniffedEnv.appName,
+		secrets: filtered,
+		found: found.sort(),
+		missing: missing.sort()
+	};
+}
 /**
-* Provision everything the workspace declares, and return what it resolved.
+* Encrypt filtered secrets for an app.
+* Generates an ephemeral master key that should be injected into Dokploy.
+*
+* @param filteredSecrets - The filtered secrets for the app
+* @returns Encrypted payload with master key
 */
-async function provisionDeclared(options) {
-	const { workspace } = options;
-	const empty = {
-		env: {},
-		statements: [],
-		provisioned: {},
-		clusters: {}
-	};
-	const manifest = options.manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root
-	});
-	if (Object.keys(manifest).length === 0) return empty;
-	const context = {
-		manifest,
-		provisioned: {},
-		api: options.api,
-		projectId: options.projectId,
-		environmentId: options.environmentId,
-		stage: options.stage,
-		project: workspace.name,
-		scope: options.scope ?? workspace.name,
-		cache: cacheBackendFor(providerOf(workspace)),
-		events: eventsBackendFor(providerOf(workspace)),
-		storage: storageBackendFor(providerOf(workspace)),
-		addresses: surfaceAddresses(manifest, options.appUrls),
-		seed: options.seed,
-		...options.supplied ? { supplied: options.supplied } : {},
-		deferred: [],
-		clusters: {}
-	};
-	const env = {};
-	for (const id of carriersLast(provisionOrder(manifest), manifest)) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const provisioner = provisionerFor(declaration.kind);
-		if (!provisioner) continue;
-		const result = await provisioner(declaration, context);
-		context.provisioned[id] = result;
-		Object.assign(env, result.provides);
-	}
+function encryptSecretsForApp(filteredSecrets) {
+	const payload = encryptSecrets(filteredSecrets.secrets);
 	return {
-		env,
-		statements: context.deferred.map((statement) => ({
-			id: statement.id,
-			describe: statement.describe,
-			...statement.database ? { database: statement.database } : {},
-			...statement.exists ? { exists: statement.exists } : {},
-			create: statement.sql
-		})),
-		provisioned: context.provisioned,
-		clusters: context.clusters
+		appName: filteredSecrets.appName,
+		payload,
+		masterKey: payload.masterKey,
+		secretCount: Object.keys(filteredSecrets.secrets).length,
+		missingSecrets: filteredSecrets.missing
 	};
 }
 /**
-* Run the deferred DDL against a cluster that is now reachable.
+* Filter and encrypt secrets for an app in one step.
 *
-* The same applier the local target uses: every statement asks whether it is
-* needed first, so a redeploy is free and a half-applied run recovers by being
-* run again.
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Encrypted secrets with master key
 */
-async function applyDeclared(client, statements) {
-	return (await applyPostgres(client, statements)).filter((entry) => entry.created).length;
+function prepareSecretsForApp(stageSecrets, sniffedEnv) {
+	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
 }
 /**
-* The provisioning order, with queues and topics moved to the end.
-*
-* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
-* *derived from* a database, because under SNS it does not live in one. Where
-* it lives is a fact about the backend, which is config — so the dependency is
-* real under pg-boss and absent under SNS, and writing it into the declaration
-* would state it in the one place that cannot know.
+* Prepare secrets for multiple apps.
 *
-* Here it can. This runs where the backend is known, and the rule needs no
-* branch on it: nothing depends on a carrier. A queue's worker and a topic's
-* subscribers are *bound* to it rather than dependent on it, which is why
-* neither holds a key of its own — so a carrier can always go last, and under
-* pg-boss that is exactly late enough for the database it reads to be there.
+* @param stageSecrets - All secrets for the stage
+* @param sniffedApps - Map of app name to sniffed environment
+* @returns Map of app name to encrypted secrets
 */
-function carriersLast(ordered, manifest) {
-	const carries = (id) => {
-		const kind = manifest[id]?.kind;
-		return kind === "queue" || kind === "topic";
-	};
-	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
+function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
+		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
+		results.set(appName, encrypted);
+	}
+	return results;
 }
 /**
-* Where each declared surface answers: its own app's address.
-*
-* Every surface is an app of its own, keyed by its id the way the derivation
-* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
-* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
-* address, so a workspace with two APIs pointed both at the same one.
+* Generate a report on secrets preparation.
 */
-function surfaceAddresses(manifest, appUrls) {
-	const addresses = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api") continue;
-		const url = appUrls[appKey(id)];
-		if (url) addresses[id] = url;
+function generateSecretsReport(encryptedApps, sniffedApps) {
+	const appsWithSecrets = [];
+	const appsWithoutSecrets = [];
+	const appsWithMissingSecrets = [];
+	for (const [appName, sniffedEnv] of sniffedApps) {
+		if (sniffedEnv.requiredEnvVars.length === 0) {
+			appsWithoutSecrets.push(appName);
+			continue;
+		}
+		const encrypted = encryptedApps.get(appName);
+		if (encrypted) {
+			appsWithSecrets.push(appName);
+			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
+				appName,
+				missing: encrypted.missingSecrets
+			});
+		}
 	}
-	return addresses;
+	return {
+		totalApps: sniffedApps.size,
+		appsWithSecrets: appsWithSecrets.sort(),
+		appsWithoutSecrets: appsWithoutSecrets.sort(),
+		appsWithMissingSecrets
+	};
 }
 //#endregion
-//#region src/deploy/dns/DnsProvider.ts
+//#region src/target/dokploy/fromManifest.ts
 /**
-* Check if value is a DnsProvider implementation.
+* The Dokploy target, read off the construct manifest.
+*
+* The AWS target has done this since `fromManifest` landed: a table keyed by
+* declaration kind, each entry turning one declaration into infrastructure and
+* the env keys it resolves. Dokploy had no such thing — it resolved environment
+* from the *sniffer*, which walks application code for `get('X')` calls, and a
+* construct reads its own key inside `@geekmidas/constructs` where there is
+* nothing to find. So a declared app deployed here got none of the model, and
+* nothing reported the absence: the deploy succeeded and the first request that
+* needed a URL failed at runtime.
+*
+* This is the same table, over the REST wrapper instead of over Pulumi.
+*
+* **Two phases, and the split is not incidental.** Creating a Postgres and
+* creating a role inside it are different kinds of act: the first is an API
+* call, the second needs a connection to a database that does not exist yet
+* when the call is made. So provisioners *accumulate* DDL rather than running
+* it, and it is applied once against a cluster that is up — which is exactly
+* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+*
+* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
+* the same generators the local target and the AWS target use. Dokploy used to
+* write its own `DO $$` block, which meant three targets applying three
+* different definitions of "the role split" and no way to notice they had
+* drifted.
+*
+* Entries are deliberately small and free of I/O ordering: each takes what it
+* needs and returns what it resolved. That is what would let a Pulumi dynamic
+* provider wrap one later without the table itself changing — see §6b.
 */
-function isDnsProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+/**
+* The internal hostname a Dokploy Postgres answers on.
+*
+* Its own service name on the Docker network — not the server's public address.
+* An app reaching its database over the public internet would be a credential
+* crossing a network that did not need to see it.
+*/
+function clusterHost(postgres) {
+	return postgres.appName;
 }
 /**
-* Create a DNS provider based on configuration.
+* What a resource is called in the provider.
+*
+* `cloudName` and nothing else — the same scoped kebab rule the AWS target
+* uses, so a name reads identically on both: `production-shop-orders`.
 *
-* - 'hostinger': HostingerProvider
-* - 'route53': Route53Provider
-* - 'manual': Returns null (user handles DNS)
-* - Custom: Use provided DnsProvider implementation
+* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
+* is one flat list where an application and its database would collide. It is
+* not: `project.one` returns typed collections — `applications`, `postgres`,
+* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
+* the shape of the response and an application and a Postgres of the same name
+* are different objects with different ids. The suffix was answering a question
+* nobody had asked.
 */
-async function createDnsProvider(options) {
-	const { config } = options;
-	if (config.provider === "manual") return null;
-	if (isDnsProvider(config.provider)) return config.provider;
-	const provider = config.provider;
-	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-x9gQTAGZ.mjs");
-		return new HostingerProvider();
-	}
-	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-Cvj40A8I.mjs");
-		const route53Config = config;
-		return new Route53Provider({
-			region: route53Config.region,
-			profile: route53Config.profile,
-			hostedZoneId: route53Config.hostedZoneId
+function serviceName(scope, id) {
+	return cloudName(scope, id);
+}
+const PROVISIONERS = {
+	/**
+	* A Postgres service, plus the roles that reach it.
+	*
+	* The service is `findOrCreate`, because a deploy that recreated the
+	* database would be a deploy that lost the data. The roles are deferred:
+	* they need a connection to a cluster this call has only just asked for.
+	*/
+	database: async (declaration, context) => {
+		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
+		const name = resourceName(declaration.id, declaration.kind, context.stage);
+		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id), context.projectId, context.environmentId, {
+			databaseName: name,
+			databasePassword: derivedPassword(context, `${name}:master`)
+		});
+		const host = clusterHost(postgres);
+		context.clusters[postgres.databaseName] = postgres;
+		const schema = declaration.schema ?? "app";
+		const runtime = name;
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: postgres.databaseName,
+			ownsDatabase: true,
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
+		} };
+	},
+	/**
+	* A schema in the parent's database, with its own role and its own URL — so
+	* the parent's role holds no grant on these tables at all.
+	*/
+	"database-schema": async (declaration, context) => {
+		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const runtime = resourceName(declaration.id, declaration.kind, context.stage);
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: parentUrl.pathname.slice(1),
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema: declaration.schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), parentUrl.hostname, parentUrl.pathname.slice(1)),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), parentUrl.hostname, parentUrl.pathname.slice(1))
+		} };
+	},
+	/**
+	* A read-only endpoint on the same cluster.
+	*
+	* Nothing is provisioned: a Dokploy Postgres has one endpoint, so this
+	* resolves to the writer's address — and that is safe rather than a
+	* loophole, because read-only is enforced by the reader role's grants and
+	* not by which host the URL names. The role itself was created with its
+	* parent.
+	*/
+	"database-reader": async (declaration, context) => {
+		if (declaration.kind !== "database-reader") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		const reader = readerRole(parentUrl.username);
+		return { provides: { [provideKey(declaration.id, "url")]: postgresUrl(reader, derivedPassword(context, reader), parentUrl.hostname, parentUrl.pathname.slice(1)) } };
+	},
+	/**
+	* A cache, wherever the project said it lives.
+	*
+	* `db` is a table in a database the manifest already declares, so it
+	* provisions no service and costs nothing to run — the same relationship
+	* pg-boss has. The table's DDL is deferred with the roles, and the table
+	* name travels in the URL because two caches in one database resolve the
+	* same connection string.
+	*/
+	cache: async (declaration, context) => {
+		if (declaration.kind !== "cache") throw new WrongKind(declaration.kind);
+		const parentId = declaration.of ?? (context.cache === "db" ? soleDatabase(context) : void 0);
+		if (!parentId) throw new CacheNeedsAHome(declaration.id, context.cache);
+		const parent = context.provisioned[parentId];
+		if (!parent) throw new UnresolvedParent(declaration.id, parentId);
+		const parentUrl = parent.provides[provideKey(parentId, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, parentId);
+		const table = declaration.table ?? cacheTable(declaration.id);
+		const schema = schemaOf(context.manifest, parentId);
+		const qualified = schema ? `${schema}.${table}` : table;
+		context.deferred.push(...cacheTableStatements({ table: qualified }).map((statement) => ({
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: statement.describe,
+			sql: statement.sql,
+			...statement.exists ? { exists: statement.exists } : {}
+		})), {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${qualified} is owned by its schema's owner`,
+			sql: `ALTER TABLE ${quoted(qualified)} OWNER TO ${quoted(ownerRole(new URL(parentUrl).username))}`
+		}, {
+			id: declaration.id,
+			database: new URL(parentUrl).pathname.slice(1),
+			describe: `${new URL(parentUrl).username} may read and write ${qualified}`,
+			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoted(qualified)} TO ${quoted(new URL(parentUrl).username)}`
+		});
+		const url = new URL(parentUrl);
+		url.searchParams.set("table", table);
+		return { provides: { [provideKey(declaration.id, "url")]: url.toString() } };
+	},
+	/**
+	* A bucket, as a MinIO stack on the box.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* object storage, so this is the one kind whose infrastructure this target
+	* *writes* rather than configures — a compose file with one service in it.
+	*
+	* The service is named `cloudName(...)` like everything else, which is not
+	* cosmetic here: containers on `dokploy-network` resolve each other by
+	* service name, so the name is the address. Calling it `minio` would work
+	* for exactly one project on the box and then collide.
+	*
+	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
+	* reads them from an execution role, so a URL that embedded a key would be
+	* one more thing to rotate and leak. There is no role here, so the same
+	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
+	* locally.
+	*/
+	objects: async (declaration, context) => {
+		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const backend = context.storage ?? "minio";
+		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
+		const user = `${bucket}-root`;
+		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
+			service,
+			bucket,
+			user,
+			password
+		}));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[provideKey(declaration.id, "url")]: s3Url(service, bucket),
+			AWS_ACCESS_KEY_ID: user,
+			AWS_SECRET_ACCESS_KEY: password,
+			AWS_REGION: MINIO_REGION
+		} };
+	},
+	/**
+	* The address a bucket's objects are served on.
+	*
+	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
+	* behind the first would terminate TLS twice — which is why the local
+	* target's Caddy has no equivalent here. What this resolves is the address,
+	* and the `open` prefixes are applied to the bucket rather than to an edge,
+	* so a policy is what makes them public wherever the bucket lives.
+	*
+	* Until a Traefik rule exists it answers on MinIO directly, path-style,
+	* which is honest about the shape it has today: the bucket is in the path
+	* rather than fronted by a host of its own.
+	*/
+	"file-server": async (declaration, context) => {
+		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const parentUrl = context.provisioned[declaration.of]?.provides[provideKey(declaration.of, "url")];
+		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
+		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
+		const bucket = new URL(parentUrl).hostname;
+		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
+		return { provides: { [provideKey(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* A topic, and below it a queue — the same broker either way.
+	*
+	* Under pg-boss there is nothing to create in Dokploy: the broker is a
+	* schema tenant of the database the app already declared, exactly as it is
+	* locally, so what this resolves is an address rather than a service. Which
+	* is the point of putting the backend in config — the same handlers drain
+	* pg-boss here and SQS on AWS because the string they were handed said so.
+	*
+	* The tenant gets its own role rather than the cluster master, for the
+	* reason every other tenant does: pg-boss creates and owns its tables, and
+	* a broker that could also read the application's is a broker with a grant
+	* nothing asked for.
+	*/
+	topic: async (declaration, context) => {
+		if (declaration.kind !== "topic") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	queue: async (declaration, context) => {
+		if (declaration.kind !== "queue") throw new WrongKind(declaration.kind);
+		return broker(declaration.id, context);
+	},
+	/**
+	* A signing key, generated once and remembered in the stage's store.
+	*
+	* Random, never derived: a key computed from the project and stage names
+	* signs sessions anyone reading the repo could forge. The deploy generates
+	* it before provisioning (`withGeneratedSecrets`) and every later deploy
+	* reads the same one, so live sessions survive a redeploy. Nothing is
+	* created in Dokploy: a secret has no address.
+	*/
+	secret: async (declaration, context) => {
+		if (declaration.kind !== "secret") throw new WrongKind(declaration.kind);
+		const key = declaration.provides?.[0];
+		if (!key) return { provides: {} };
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* A third party's credentials, as the stage was given them.
+	*
+	* Nothing is created and nothing derived: the value was issued by somebody
+	* else. A stage that was never given one fails the deploy here, naming the
+	* command that sets it — not the first request that needs it.
+	*/
+	credential: async (declaration, context) => {
+		if (declaration.kind !== "credential") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "credentials");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
+	* An API somebody else runs: the URL this stage calls it at, and the
+	* credentials it was issued for this stage.
+	*/
+	"external-api": async (declaration, context) => {
+		if (declaration.kind !== "external-api") throw new WrongKind(declaration.kind);
+		const credentials = provideKey(declaration.id, "credentials");
+		return { provides: {
+			[provideKey(declaration.id, "url")]: externalApiUrl(declaration, context.stage),
+			[credentials]: supplied(declaration.id, credentials, context)
+		} };
+	},
+	/**
+	* A surface, at the address whatever created its domain assigned.
+	*
+	* Nothing is provisioned here: the application and its domain are the
+	* existing engine's, and Dokploy's own Traefik terminates TLS with a Let's
+	* Encrypt certificate. What this adds is the *derivation* — who may call it,
+	* and where a cookie it sets is readable — from the graph rather than from a
+	* hand-maintained list.
+	*/
+	"rest-api": async (declaration, context) => {
+		if (declaration.kind !== "rest-api") throw new WrongKind(declaration.kind);
+		const url = context.addresses?.[declaration.id];
+		if (!url) throw new SurfaceHasNoAddress(declaration.id);
+		const origins = [...new Set(dependentsOf(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
+		const domain = cookieDomain([url, ...origins]);
+		const schemes = dependentsOf(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? mobileOrigins(schemeBase(context.project, app.scheme)) : [];
 		});
+		return { provides: {
+			[provideKey(declaration.id, "url")]: url,
+			[provideKey(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
+			...domain ? { [provideKey(declaration.id, "cookieDomain")]: domain } : {}
+		} };
 	}
-	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
-	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
-}
-//#endregion
-//#region src/deploy/dns/index.ts
-/**
-* DNS orchestration for deployments
-*
-* Handles automatic DNS record creation for deployed applications.
-*/
-const logger$2 = output;
-/**
-* Check if DNS config is legacy format (single domain with `domain` property)
-*/
-function isLegacyDnsConfig(config) {
-	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
-}
-/**
-* Normalize DNS config to new multi-domain format
-*/
-function normalizeDnsConfig(config) {
-	if (isLegacyDnsConfig(config)) {
-		const { domain, ...providerConfig } = config;
-		return { [domain]: providerConfig };
-	}
-	return config;
-}
-/**
-* Find the root domain for a hostname from available DNS configs
-*
-* @example
-* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
-* // Returns 'geekmidas.com'
-*/
-function findRootDomain(hostname, dnsConfig) {
-	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
-	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
-	return null;
-}
-/**
-* Group hostnames by their root domain
-*/
-function groupHostnamesByDomain(appHostnames, dnsConfig) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const [appName, hostname] of appHostnames) {
-		const rootDomain = findRootDomain(hostname, dnsConfig);
-		if (!rootDomain) {
-			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
-			continue;
-		}
-		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
-		grouped.get(rootDomain).set(appName, hostname);
-	}
-	return grouped;
-}
-/**
-* Resolve IP address from a hostname
-*/
-async function resolveHostnameToIp(hostname) {
-	try {
-		return (await lookup(hostname, { family: 4 })).address;
-	} catch (error) {
-		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
-	}
+};
+/** The provisioner for a kind, or nothing where this target has none yet. */
+function provisionerFor(kind) {
+	return PROVISIONERS[kind];
 }
 /**
-* Extract subdomain from full hostname relative to root domain
+* The role DDL for one database or tenant, from the shared generator.
 *
-* @example
-* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
-* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
-*/
-function extractSubdomain(hostname, rootDomain) {
-	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
-	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
-}
-/**
-* Generate required DNS records for a deployment
-*/
-function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
-	const records = [];
-	for (const [appName, hostname] of appHostnames) {
-		const subdomain = extractSubdomain(hostname, rootDomain);
-		records.push({
-			hostname,
-			subdomain,
-			type: "A",
-			value: serverIp,
-			appName
-		});
-	}
-	return records;
-}
-/**
-* Print DNS records table
-*/
-function printDnsRecordsTable(records, rootDomain) {
-	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
-	for (const record of records) {
-		const subdomain = record.subdomain.padEnd(35);
-		const type = record.type.padEnd(4);
-		const value = record.value.padEnd(15);
-		let status;
-		if (record.error) status = "✗";
-		else if (record.created) status = "✓ new";
-		else if (record.existed) status = "✓";
-		else status = "?";
-		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
-	}
-	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
-}
-/**
-* Print DNS records in a simple format for manual setup
-*/
-function printDnsRecordsSimple(records, rootDomain) {
-	logger$2.log("\n   📋 Required DNS Records:");
-	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$2.log("");
-}
-/**
-* Create DNS records for a single domain using its configured provider
+* The same statements the local target applies and the same ones the AWS
+* bootstrap runs. Dokploy used to write its own, which is how three targets
+* came to hold three definitions of the same split.
 */
-async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
-	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
-	let provider;
-	try {
-		provider = await createDnsProvider({ config: providerConfig });
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			...r,
-			error: message
-		}));
-	}
-	if (!provider) return records.map((r) => ({
-		...r,
-		created: false,
-		existed: false
-	}));
-	const results = [];
-	const upsertRecords = records.map((r) => ({
-		name: r.subdomain,
-		type: r.type,
-		ttl,
-		value: r.value
-	}));
-	try {
-		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
-		for (const [i, record] of records.entries()) {
-			const result = upsertResults[i];
-			if (!result) {
-				results.push({
-					hostname: record.hostname,
-					subdomain: record.subdomain,
-					type: record.type,
-					value: record.value,
-					appName: record.appName,
-					error: "No result returned from provider"
-				});
-				continue;
-			}
-			if (result.unchanged) results.push({
-				hostname: record.hostname,
-				subdomain: record.subdomain,
-				type: record.type,
-				value: record.value,
-				appName: record.appName,
-				existed: true,
-				created: false
-			});
-			else results.push({
-				hostname: record.hostname,
-				subdomain: record.subdomain,
-				type: record.type,
-				value: record.value,
-				appName: record.appName,
-				created: result.created,
-				existed: !result.created
-			});
+function statementsFor(options) {
+	const { id, database, runtime, owner, reader, schema, context } = options;
+	return roleStatements({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		...options.ownsDatabase ? { database } : {},
+		passwords: {
+			runtime: derivedPassword(context, runtime),
+			owner: derivedPassword(context, owner),
+			...reader ? { reader: derivedPassword(context, reader) } : {}
 		}
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			hostname: r.hostname,
-			subdomain: r.subdomain,
-			type: r.type,
-			value: r.value,
-			appName: r.appName,
-			error: message
-		}));
-	}
-	return results;
+	}).map((statement) => ({
+		...statement,
+		id,
+		database
+	}));
 }
 /**
-* Main DNS orchestration function for deployments
+* The connection string a declared queue or topic publishes on.
 *
-* Supports both legacy single-domain format and new multi-domain format:
-* - Legacy: { provider: 'hostinger', domain: 'example.com' }
-* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+* One broker for the whole project, which is what the local target does and
+* what the runtime expects: the generated pollers open a single connection and
+* subscribe each worker by name on it. So every carrier resolves to the same
+* address, and the DDL that backs it is pushed once however many are declared.
 *
-* @param appHostnames - Map of app names to hostnames
-* @param dnsConfig - DNS configuration (legacy or multi-domain)
-* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
-* @param state - Optional state to save created records for later deletion
+* Only pg-boss is answered here. SNS needs a topic ARN that has to exist
+* first, and RabbitMQ needs a broker Dokploy has no primitive for — both are
+* the §4.3 question, and composing a plausible URL for either would fail at the
+* first publish instead of here.
 */
-async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
-	if (!dnsConfig) return null;
-	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$2.log("\n🌐 Setting up DNS records...");
-	let serverIp;
-	try {
-		const endpointUrl = new URL(dokployEndpoint);
-		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
-		return null;
-	}
-	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
-	if (groupedHostnames.size === 0) {
-		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
-		return {
-			records: [],
-			success: true,
-			serverIp
-		};
-	}
-	const allRecords = [];
-	let hasFailures = false;
-	for (const [rootDomain, domainHostnames] of groupedHostnames) {
-		const providerConfig = normalizedConfig[rootDomain];
-		if (!providerConfig) {
-			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
-			continue;
-		}
-		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
-		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
-		if (requiredRecords.length === 0) continue;
-		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
-		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
-		allRecords.push(...domainRecords);
-		const created = domainRecords.filter((r) => r.created).length;
-		const existed = domainRecords.filter((r) => r.existed).length;
-		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
-		if (failed > 0) {
-			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
-			hasFailures = true;
-		}
-		if (state) {
-			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
-				domain: rootDomain,
-				name: record.subdomain,
-				type: record.type,
-				value: record.value,
-				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
-			});
-		}
-		printDnsRecordsTable(domainRecords, rootDomain);
-		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+function broker(id, context) {
+	const backend = context.events ?? "pgboss";
+	if (backend !== "pgboss") throw new UnprovisionableCarrier(id, backend);
+	const parentId = soleDatabase(context);
+	if (!parentId) throw new BrokerNeedsADatabase(id);
+	const parentUrl = context.provisioned[parentId]?.provides[provideKey(parentId, "url")];
+	if (!parentUrl) throw new UnresolvedParent(id, parentId);
+	const url = new URL(parentUrl);
+	const database = url.pathname.slice(1);
+	const runtime = `${database}_${PGBOSS_SCHEMA}`;
+	const owner = ownerRole(runtime);
+	if (!context.provisioned[BROKER_ID]) {
+		context.deferred.push(...statementsFor({
+			id: BROKER_ID,
+			database,
+			runtime,
+			owner,
+			schema: PGBOSS_SCHEMA,
+			context
+		}));
+		context.provisioned[BROKER_ID] = { provides: {} };
 	}
-	return {
-		records: allRecords,
-		success: !hasFailures,
-		serverIp
-	};
+	const connection = pgbossUrl(runtime, derivedPassword(context, runtime), url.host, database);
+	return { provides: { [provideKey(id, "publisherConnectionString")]: connection } };
 }
+/** The schema pg-boss creates its tables in, here as locally. */
+const PGBOSS_SCHEMA = "pgboss";
 /**
-* Verify DNS records resolve correctly after deployment.
+* The id the broker's DDL is pushed under.
 *
-* This function:
-* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
-* 2. Attempts to resolve each hostname to an IP
-* 3. Compares resolved IP with expected server IP
-* 4. Updates state with verification results
+* Not a construct — no declaration names it — but the deferred statements need
+* an id, and every carrier in the project shares this one.
+*/
+const BROKER_ID = "PgBoss";
+/**
+* A pg-boss address: a Postgres URL under a scheme that picks the transport.
 *
-* @param appHostnames - Map of app names to hostnames
-* @param serverIp - Expected IP address the hostnames should resolve to
-* @param state - Deploy state for caching verification results
-* @returns Array of verification results
+* The protocol is what a producer branches on, so it never branches — the same
+* `.publish()` reaches pg-boss here and SQS on AWS.
 */
-async function verifyDnsRecords(appHostnames, serverIp, state) {
-	const results = [];
-	logger$2.log("\n🔍 Verifying DNS records...");
-	for (const [appName, hostname] of appHostnames) {
-		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$2.log(`   ✓ ${hostname} (previously verified)`);
-			results.push({
-				hostname,
-				appName,
-				verified: true,
-				expectedIp: serverIp,
-				skipped: true
-			});
-			continue;
-		}
-		try {
-			const resolvedIp = await resolveHostnameToIp(hostname);
-			if (resolvedIp === serverIp) {
-				setDnsVerification(state, hostname, serverIp);
-				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
-				results.push({
-					hostname,
-					appName,
-					verified: true,
-					resolvedIp,
-					expectedIp: serverIp
-				});
-			} else {
-				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
-				results.push({
-					hostname,
-					appName,
-					verified: false,
-					resolvedIp,
-					expectedIp: serverIp
-				});
-			}
-		} catch (error) {
-			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
-			results.push({
-				hostname,
-				appName,
-				verified: false,
-				expectedIp: serverIp,
-				error: message
-			});
-		}
-	}
-	const verified = results.filter((r) => r.verified).length;
-	const skipped = results.filter((r) => r.skipped).length;
-	const pending = results.filter((r) => !r.verified).length;
-	if (pending > 0) {
-		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
-	return results;
+function pgbossUrl(role, password, host, database) {
+	return `pgboss://${role}:${encodeURIComponent(password)}@${host}/${database}?schema=${PGBOSS_SCHEMA}`;
+}
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
+/** An `s3://` URL pointing the same S3 client at MinIO on the internal network. */
+function s3Url(service, bucket) {
+	return `s3://${bucket}?region=${MINIO_REGION}&endpoint=http://${service}:9000&forcePathStyle=true`;
+}
+/**
+* A one-service compose file for a bucket.
+*
+* `dokploy-network` is external and already exists — it is what every Dokploy
+* service is attached to, and joining it is what makes the app able to resolve
+* this one by name. The bucket itself is created by MinIO's entrypoint rather
+* than by a second call, so there is nothing to reconcile afterwards.
+*/
+function minioCompose(options) {
+	const { service, bucket, user, password } = options;
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+		`    command: server /data --console-address ":9001"`,
+		"    environment:",
+		`      MINIO_ROOT_USER: ${user}`,
+		`      MINIO_ROOT_PASSWORD: ${password}`,
+		"    volumes:",
+		`      - ${service}-data:/data`,
+		"    networks:",
+		"      - dokploy-network",
+		"    healthcheck:",
+		"      test: [\"CMD\", \"mc\", \"ready\", \"local\"]",
+		"      interval: 10s",
+		"      retries: 5",
+		`  ${service}-bucket:`,
+		"    image: minio/mc:latest",
+		"    depends_on:",
+		`      ${service}:`,
+		"        condition: service_healthy",
+		"    entrypoint: >",
+		`      /bin/sh -c "mc alias set s3 http://${service}:9000 ${user} ${password} &&`,
+		`      mc mb --ignore-existing s3/${bucket}"`,
+		"    networks:",
+		"      - dokploy-network",
+		"volumes:",
+		`  ${service}-data:`,
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/** Whether anything reads through a reader on this construct. */
+function readsFrom(manifest, id) {
+	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
+}
+/** The schema a database or tenant pins on its roles. */
+function schemaOf(manifest, id) {
+	const declaration = manifest[id];
+	if (declaration?.kind === "database") return declaration.schema ?? "app";
+	if (declaration?.kind === "database-schema") return declaration.schema;
 }
-//#endregion
-//#region src/deploy/docker.ts
-const logger$1 = output;
 /**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
+* The one declared database, where `cache: 'db'` has to pick.
+*
+* Unambiguous with one and arbitrary with two, so two is an error rather than a
+* coin toss — a cache landing in a database nobody chose surfaces as entries
+* that are never found, long after the deploy reported success.
 */
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
+function soleDatabase(context) {
+	const databases = Object.entries(context.manifest).filter(([, declaration]) => declaration.kind === "database").map(([id]) => id);
+	if (databases.length > 1) throw new CacheIsAmbiguous(databases);
+	return databases[0];
+}
 /**
-* Get the full image reference
+* A password derived from the stage's seed, the project, the stage and the role.
+*
+* Derived rather than stored per role so a redeploy hands the running
+* application the password it already has, and two projects never share one.
+* The seed is what makes it secret: random, generated once and kept in the
+* stage's store. Without it the inputs are all in the repo, and so was every
+* production password.
 */
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
+function derivedPassword(context, role) {
+	return createHash("sha256").update(`${context.seed}:${context.project}:${context.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/** A connection string for a role on a cluster. */
+function postgresUrl(role, password, host, database) {
+	return `postgres://${role}:${encodeURIComponent(password)}@${host}:5432/${database}`;
+}
+/** Quote an identifier, per segment, for DDL that cannot be parameterised. */
+function quoted(name) {
+	return name.split(".").map((part) => `"${part.replace(/"/g, "\"\"")}"`).join(".");
 }
+/** A provisioner was handed a declaration of the wrong kind. */
 /**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
+* A value only the stage's own secrets can hold.
 *
-* @internal Exported for testing
+* @throws {MissingSuppliedSecret} when the stage was never given it.
 */
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
+function supplied(id, key, context) {
+	const value = context.supplied?.[key];
+	if (value === void 0) throw new MissingSuppliedSecret(id, key, context.stage);
+	return value;
 }
+/** A construct needs a value the stage was never given. */
+var MissingSuppliedSecret = class extends Error {
+	id;
+	key;
+	stage;
+	constructor(id, key, stage) {
+		super(`'${id}' needs ${key}, and the stage '${stage}' has none. Nothing can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "MissingSuppliedSecret";
+	}
+};
+var WrongKind = class extends Error {
+	kind;
+	constructor(kind) {
+		super(`No Dokploy provisioner handles '${kind}'`);
+		this.kind = kind;
+		this.name = "WrongKind";
+	}
+};
+/** A derived construct whose parent has not been provisioned. */
+var UnresolvedParent = class extends Error {
+	id;
+	parent;
+	constructor(id, parent) {
+		super(`'${id}' derives from '${parent}', which has not been provisioned. Provision in \`provisionOrder\`, which puts parents first.`);
+		this.id = id;
+		this.parent = parent;
+		this.name = "UnresolvedParent";
+	}
+};
+/** A cache with nowhere to live. */
+var CacheNeedsAHome = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
+		this.id = id;
+		this.backend = backend;
+		this.name = "CacheNeedsAHome";
+	}
+};
+/** A `'db'` cache (a server target's default) with more than one database. */
+var CacheIsAmbiguous = class extends Error {
+	databases;
+	constructor(databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+/** A surface reached provisioning before its domain existed. */
+var SurfaceHasNoAddress = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is a surface and no address was supplied for it. The domain is created before the manifest is provisioned, so this means the two ran out of order.`);
+		this.id = id;
+		this.name = "SurfaceHasNoAddress";
+	}
+};
+/** A queue or topic on a backend this target has no primitive for. */
+var UnprovisionableCarrier = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableCarrier";
+	}
+};
+/** A pg-boss carrier in an app that declares no database to host it. */
+var BrokerNeedsADatabase = class extends Error {
+	id;
+	constructor(id) {
+		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
+		this.id = id;
+		this.name = "BrokerNeedsADatabase";
+	}
+};
+/** A bucket on a backend this target has no primitive for. */
+var UnprovisionableBucket = class extends Error {
+	id;
+	backend;
+	constructor(id, backend) {
+		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
+		this.id = id;
+		this.backend = backend;
+		this.name = "UnprovisionableBucket";
+	}
+};
+//#endregion
+//#region src/target/dokploy/declared.ts
 /**
-* Write the encrypted credentials where `docker build --secret` reads them.
+* The declared half of a Dokploy deploy.
 *
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
+* `fromManifest.ts` decides what each construct resolves to; this runs it —
+* discovers the manifest, walks it parents-first, and applies the DDL the
+* provisioners deferred.
 *
-* @internal Exported for testing
+* It is deliberately separate from the engine in `index.ts`. That file deploys
+* *applications*: images, registries, domains, the things a project has whether
+* or not it declares anything. This is the part that exists because the app
+* declared it, and keeping the two apart is what lets a project adopt the model
+* without rewriting its deploy — and lets this one be tested without one.
 */
-async function writeCredentialsFile(credentials) {
-	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
-	const path = join(dir, CREDENTIALS_SECRET_ID);
-	await writeFile(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
-	await chmod(path, 384);
+/**
+* Provision everything the workspace declares, and return what it resolved.
+*/
+async function provisionDeclared(options) {
+	const { workspace } = options;
+	const empty = {
+		env: {},
+		statements: [],
+		provisioned: {},
+		clusters: {}
+	};
+	const manifest = options.manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	if (Object.keys(manifest).length === 0) return empty;
+	const context = {
+		manifest,
+		provisioned: {},
+		api: options.api,
+		projectId: options.projectId,
+		environmentId: options.environmentId,
+		stage: options.stage,
+		project: workspace.name,
+		scope: options.scope ?? workspace.name,
+		cache: cacheBackendFor(providerOf(workspace)),
+		events: eventsBackendFor(providerOf(workspace)),
+		storage: storageBackendFor(providerOf(workspace)),
+		addresses: surfaceAddresses(manifest, options.appUrls),
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
+		deferred: [],
+		clusters: {}
+	};
+	const env = {};
+	for (const id of carriersLast(provisionOrder(manifest), manifest)) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const provisioner = provisionerFor(declaration.kind);
+		if (!provisioner) continue;
+		const result = await provisioner(declaration, context);
+		context.provisioned[id] = result;
+		Object.assign(env, result.provides);
+	}
 	return {
-		path,
-		cleanup: () => rm(dir, {
-			recursive: true,
-			force: true
-		})
+		env,
+		statements: context.deferred.map((statement) => ({
+			id: statement.id,
+			describe: statement.describe,
+			...statement.database ? { database: statement.database } : {},
+			...statement.exists ? { exists: statement.exists } : {},
+			create: statement.sql
+		})),
+		provisioned: context.provisioned,
+		clusters: context.clusters
+	};
+}
+/**
+* Run the deferred DDL against a cluster that is now reachable.
+*
+* The same applier the local target uses: every statement asks whether it is
+* needed first, so a redeploy is free and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclared(client, statements) {
+	return (await applyPostgres(client, statements)).filter((entry) => entry.created).length;
+}
+/**
+* The provisioning order, with queues and topics moved to the end.
+*
+* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
+* *derived from* a database, because under SNS it does not live in one. Where
+* it lives is a fact about the backend, which is config — so the dependency is
+* real under pg-boss and absent under SNS, and writing it into the declaration
+* would state it in the one place that cannot know.
+*
+* Here it can. This runs where the backend is known, and the rule needs no
+* branch on it: nothing depends on a carrier. A queue's worker and a topic's
+* subscribers are *bound* to it rather than dependent on it, which is why
+* neither holds a key of its own — so a carrier can always go last, and under
+* pg-boss that is exactly late enough for the database it reads to be there.
+*/
+function carriersLast(ordered, manifest) {
+	const carries = (id) => {
+		const kind = manifest[id]?.kind;
+		return kind === "queue" || kind === "topic";
 	};
+	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
 }
 /**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
+* Where each declared surface answers: its own app's address.
+*
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
 */
-async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
-	logger$1.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$1.log("   Generating Dockerfile for the pre-built bundle...");
-	await dockerCommand({
-		slim: true,
-		cwd
-	});
-	const dockerfilePath = join(cwd, ".gkm", "docker", "Dockerfile");
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs,
-			credentialsFile: secret?.path
-		}), {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$1.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
+function surfaceAddresses(manifest, appUrls) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[appKey(id)];
+		if (url) addresses[id] = url;
 	}
+	return addresses;
 }
+//#endregion
+//#region src/target/dokploy/dns/DnsProvider.ts
 /**
-* Push Docker image to registry
+* Check if value is a DnsProvider implementation.
 */
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+}
+/**
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
+*/
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await import("./HostingerProvider-CY_VpVud.mjs");
+		return new HostingerProvider();
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await import("./Route53Provider-QXxjkZO1.mjs");
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
 		});
-		logger$1.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
 	}
+	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
+	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
 }
+//#endregion
+//#region src/target/dokploy/dns/index.ts
 /**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
+* DNS orchestration for deployments
 *
-* @internal Exported for testing
+* Handles automatic DNS record creation for deployed applications.
 */
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+const logger$2 = output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
 }
 /**
-* Deploy using Docker (build and optionally push image)
+* Normalize DNS config to new multi-domain format
 */
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const docker = {
-		cwd: options.cwd ?? process.cwd(),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger$1.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
 	}
-	logger$1.log("\n✅ Docker deployment ready!");
-	logger$1.log(`\n📋 Deployment details:`);
-	logger$1.log(`   Image: ${imageRef}`);
-	logger$1.log(`   Stage: ${stage}`);
-	if (masterKey) logger$1.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	return config;
 }
-//#endregion
-//#region src/deploy/env-resolver.ts
 /**
-* Environment Variable Resolution for Dokploy Deployments
+* Find the root domain for a hostname from available DNS configs
 *
-* Resolves sniffed environment variables to actual values during deployment.
-* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
-* and falls back to user-provided secrets.
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
 */
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
+}
 /**
-* Generate a secure random secret (64 hex characters = 32 bytes)
+* Group hostnames by their root domain
 */
-function generateSecret() {
-	return randomBytes(32).toString("hex");
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
+	}
+	return grouped;
 }
 /**
-* Get or generate a secret for an app.
-* If the secret already exists in state, returns it.
-* Otherwise generates a new one and stores it.
+* Resolve IP address from a hostname
 */
-function getOrGenerateSecret(state, appName, secretName) {
-	const existing = getGeneratedSecret(state, appName, secretName);
-	if (existing) return existing;
-	const generated = generateSecret();
-	setGeneratedSecret(state, appName, secretName, generated);
-	return generated;
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await lookup(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
 }
 /**
-* Resolve a single environment variable
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
 */
-function resolveEnvVar(varName, context) {
-	switch (varName) {
-		case "PORT": return String(context.app.port);
-		case "NODE_ENV": return "production";
-		case "STAGE": return context.stage;
-		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
-		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
-		case "BETTER_AUTH_TRUSTED_ORIGINS":
-			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
-			break;
-		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
-	}
-	if (context.dependencyUrls && varName.endsWith("_URL")) {
-		const depName = (stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
-		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
-	}
-	if (context.userSecrets) {
-		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
-		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
-		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
-		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
-	}
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
 }
 /**
-* Resolve all environment variables for an app
+* Generate required DNS records for a deployment
 */
-function resolveEnvVars(requiredVars, context) {
-	const resolved = {};
-	const missing = [];
-	for (const varName of requiredVars) {
-		const value = resolveEnvVar(varName, context);
-		if (value !== void 0) resolved[varName] = value;
-		else missing.push(varName);
-	}
-	return {
-		resolved,
-		missing
-	};
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
 }
 /**
-* Format missing variables error message
+* Print DNS records table
 */
-function formatMissingVarsError(appName, missing, stage) {
-	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+function printDnsRecordsTable(records, rootDomain) {
+	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+	}
+	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
-* Validate that all required environment variables can be resolved
+* Print DNS records in a simple format for manual setup
 */
-function validateEnvVars(requiredVars, context) {
-	const { resolved, missing } = resolveEnvVars(requiredVars, context);
-	return {
-		valid: missing.length === 0,
-		missing,
-		resolved
-	};
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$2.log("\n   📋 Required DNS Records:");
+	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$2.log("");
 }
-//#endregion
-//#region src/deploy/ownership.ts
-/**
-* Which Dokploy project a deploy is allowed to deploy into.
-*
-* Deploy used to take any project whose name matched the workspace's, in any
-* case — so a second workspace called `shop` (or `Shop`) on the same server
-* deployed into the first one's project, over its images and applications. A
-* project is now claimed by an ownership marker in its description, and a
-* project with the right name and no marker is somebody else's.
-*/
 /**
-* A Dokploy project with the name this deploy would use exists, and nothing
-* says this workspace created it.
+* Create DNS records for a single domain using its configured provider
 */
-var ProjectNotOwned = class extends Error {
-	projectName;
-	projectId;
-	identity;
-	ownedBy;
-	constructor(projectName, projectId, identity, ownedBy) {
-		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
-		this.projectName = projectName;
-		this.projectId = projectId;
-		this.identity = identity;
-		this.ownedBy = ownedBy;
-		this.name = "ProjectNotOwned";
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
 	}
-};
-/** A description with the marker added, keeping what was there. */
-function withMarker(description, marker) {
-	const existing = (description ?? "").trim();
-	return existing ? `${existing}\n${marker}` : marker;
-}
-/** `project.one`, or `null` when Dokploy no longer has the project. */
-async function projectById(api, projectId) {
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
 	try {
-		return await api.getProject(projectId) ?? null;
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
 	} catch (error) {
-		if (error instanceof DokployApiError) return null;
-		throw error;
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
 	}
+	return results;
 }
 /**
-* The project this identity owns, if there is one — read only, so a dry run
-* asks the same question a deploy does:
+* Main DNS orchestration function for deployments
 *
-* 1. The one the stage's state names, if Dokploy still has it. State written
-*    before markers existed is trusted — it holds an id this workspace was
-*    given when it created the project.
-* 2. One with this name *and* this identity's marker.
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
 *
-* A project that matches by name (in any case) but carries no marker, or
-* another identity's, raises `ProjectNotOwned` — it is never adopted.
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
 */
-async function findProject(api, identity, stateProjectId) {
-	const name = projectName(identity);
-	const marker = ownershipMarker(identity);
-	if (stateProjectId) {
-		const known = await projectById(api, stateProjectId);
-		if (known) {
-			const claimed = markerOf(known.description);
-			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
-			return {
-				projectId: known.projectId,
-				name: known.name,
-				description: known.description ?? null,
-				environments: known.environments ?? [],
-				via: "state",
-				needsClaim: !claimed
-			};
-		}
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$2.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
 	}
-	const projects = await api.listProjects();
-	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
-	if (owned) {
-		const details = await api.getProject(owned.projectId);
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
-			projectId: owned.projectId,
-			name: owned.name,
-			description: owned.description ?? null,
-			environments: details.environments ?? [],
-			via: "marker",
-			needsClaim: false
+			records: [],
+			success: true,
+			serverIp
 		};
 	}
-	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
-	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
-	return null;
-}
-/**
-* The project this deploy deploys into: the one {@link findProject} finds —
-* claimed with this identity's marker if it carries none yet, so the next
-* deploy without state still finds it — or a new one, marked.
-*/
-async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
-	const marker = ownershipMarker(identity);
-	const found = await findProject(api, identity, stateProjectId);
-	if (found) {
-		if (found.needsClaim) {
-			await api.updateProject(found.projectId, {
-				name: found.name,
-				description: withMarker(found.description, marker)
-			});
-			log(`   Claimed project ${found.name} for ${identity.key}`);
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
 		}
-		return {
-			projectId: found.projectId,
-			name: found.name,
-			environments: found.environments,
-			via: found.via
-		};
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
 	}
-	await hooks.beforeCreate?.();
-	const created = await api.createProject(projectName(identity), withMarker("Deployed by gkm.", marker));
 	return {
-		projectId: created.project.projectId,
-		name: created.project.name,
-		environments: [created.environment],
-		via: "created"
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
 	};
 }
-//#endregion
-//#region src/deploy/registry.ts
 /**
-* Which Dokploy registry a stage's images are pulled through.
+* Verify DNS records resolve correctly after deployment.
 *
-* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
-* when that was empty, the first registry Dokploy listed — so an image could be
-* deployed with credentials for a registry nobody chose, and two workspaces
-* deployed from one machine shared whichever was stored last. The id is now
-* kept in the stage's state, and found only from what the workspace
-* configured.
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
 */
-/** There is nowhere to push images to, so Dokploy has nothing to pull. */
-var RegistryNotConfigured = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
-		this.stage = stage;
-		this.name = "RegistryNotConfigured";
-	}
-};
-/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
-var RegistryNotFound = class extends Error {
-	registryId;
-	constructor(registryId) {
-		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
-		this.registryId = registryId;
-		this.name = "RegistryNotFound";
-	}
-};
-/** More than one Dokploy registry serves the configured registry. */
-var RegistryAmbiguous = class extends Error {
-	registry;
-	registryIds;
-	constructor(registry, registryIds) {
-		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
-		this.registry = registry;
-		this.registryIds = registryIds;
-		this.name = "RegistryAmbiguous";
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$2.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (isDnsVerified(state, hostname, serverIp)) {
+			logger$2.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				setDnsVerification(state, hostname, serverIp);
+				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
+			});
+		}
 	}
-};
-/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
-function parts(url) {
-	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
-	return {
-		host,
-		path: path.join("/")
-	};
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
 }
+//#endregion
+//#region src/target/dokploy/env-resolver.ts
 /**
-* The Dokploy registries that serve `registry`: the same host, and — where
-* Dokploy's own entry names one — the same path.
+* Environment Variable Resolution for Dokploy Deployments
+*
+* Resolves sniffed environment variables to actual values during deployment.
+* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
+* and falls back to user-provided secrets.
 */
-function serving(registries, registry) {
-	const wanted = parts(registry);
-	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
-	if (sameHost.length <= 1) return sameHost;
-	return sameHost.filter((r) => {
-		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
-	});
+/**
+* Generate a secure random secret (64 hex characters = 32 bytes)
+*/
+function generateSecret() {
+	return randomBytes(32).toString("hex");
 }
-/** `registry.one`, or `null` when Dokploy says it has no such registry. */
-async function registryById(api, registryId) {
-	try {
-		return await api.getRegistry(registryId) ?? null;
-	} catch (error) {
-		if (error instanceof DokployApiError) return null;
-		throw error;
-	}
+/**
+* Get or generate a secret for an app.
+* If the secret already exists in state, returns it.
+* Otherwise generates a new one and stores it.
+*/
+function getOrGenerateSecret(state, appName, secretName) {
+	const existing = getGeneratedSecret(state, appName, secretName);
+	if (existing) return existing;
+	const generated = generateSecret();
+	setGeneratedSecret(state, appName, secretName, generated);
+	return generated;
 }
 /**
-* The registry id for a stage, in order: the configured id, the one in the
-* stage's state, the one Dokploy has for the configured registry URL, and
-* otherwise a new one. Never a registry the workspace did not point at.
+* Resolve a single environment variable
 */
-async function resolveRegistry(api, options) {
-	const { stage, registry, configuredId, stateId, log = () => {} } = options;
-	if (!registry) throw new RegistryNotConfigured(stage);
-	if (configuredId) {
-		const configured = await registryById(api, configuredId);
-		if (!configured) throw new RegistryNotFound(configuredId);
-		return configured;
+function resolveEnvVar(varName, context) {
+	switch (varName) {
+		case "PORT": return String(context.app.port);
+		case "NODE_ENV": return "production";
+		case "STAGE": return context.stage;
+		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
+		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
+		case "BETTER_AUTH_TRUSTED_ORIGINS":
+			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
+			break;
+		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
 	}
-	if (stateId) {
-		const known = await registryById(api, stateId);
-		if (known) return known;
-		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	if (context.dependencyUrls && varName.endsWith("_URL")) {
+		const depName = (stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
+		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
+	}
+	if (context.userSecrets) {
+		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
+		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
+		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
+		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
 	}
-	const matches = serving(await api.listRegistries(), registry);
-	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
-	if (matches[0]) return matches[0];
-	return options.create(registry);
 }
-//#endregion
-//#region src/deploy/secrets.ts
 /**
-* Filter secrets to only include the env vars that an app requires.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
-* @returns Filtered secrets with found/missing tracking
+* Resolve all environment variables for an app
 */
-function filterSecretsForApp(stageSecrets, sniffedEnv) {
-	const allSecrets = toEmbeddableSecrets(stageSecrets);
-	const filtered = {};
-	const found = [];
+function resolveEnvVars(requiredVars, context) {
+	const resolved = {};
 	const missing = [];
-	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
-		filtered[key] = allSecrets[key];
-		found.push(key);
-	} else missing.push(key);
+	for (const varName of requiredVars) {
+		const value = resolveEnvVar(varName, context);
+		if (value !== void 0) resolved[varName] = value;
+		else missing.push(varName);
+	}
 	return {
-		appName: sniffedEnv.appName,
-		secrets: filtered,
-		found: found.sort(),
-		missing: missing.sort()
+		resolved,
+		missing
 	};
 }
 /**
-* Encrypt filtered secrets for an app.
-* Generates an ephemeral master key that should be injected into Dokploy.
-*
-* @param filteredSecrets - The filtered secrets for the app
-* @returns Encrypted payload with master key
+* Format missing variables error message
 */
-function encryptSecretsForApp(filteredSecrets) {
-	const payload = encryptSecrets(filteredSecrets.secrets);
+function formatMissingVarsError(appName, missing, stage) {
+	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+}
+/**
+* Validate that all required environment variables can be resolved
+*/
+function validateEnvVars(requiredVars, context) {
+	const { resolved, missing } = resolveEnvVars(requiredVars, context);
 	return {
-		appName: filteredSecrets.appName,
-		payload,
-		masterKey: payload.masterKey,
-		secretCount: Object.keys(filteredSecrets.secrets).length,
-		missingSecrets: filteredSecrets.missing
+		valid: missing.length === 0,
+		missing,
+		resolved
 	};
 }
-/**
-* Filter and encrypt secrets for an app in one step.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
-* @returns Encrypted secrets with master key
-*/
-function prepareSecretsForApp(stageSecrets, sniffedEnv) {
-	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+//#endregion
+//#region src/target/dokploy/health.ts
+/** How long one request may take: a check that hangs is a failed check. */
+const REQUEST_TIMEOUT_MS = 1e4;
+/** An app never answered healthy enough times in a row. */
+var HealthCheckTimedOut = class extends Error {
+	app;
+	url;
+	timeoutMs;
+	lastStatus;
+	constructor(app, url, timeoutMs, lastStatus) {
+		super(`${app} did not become healthy within ${Math.round(timeoutMs / 1e3)}s: ${url} last ${lastStatus === void 0 ? "did not answer" : `answered ${lastStatus}`}. Check the app's logs in Dokploy. If it is only slow to start, raise deploy.dokploy.verify.healthTimeoutMs; if it serves its health route elsewhere, set deploy.dokploy.verify.healthCheckPath.`);
+		this.app = app;
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "HealthCheckTimedOut";
+	}
+};
+/** Wait `ms`, or reject with the signal's reason once it aborts. */
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) return reject(signal.reason);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal.reason);
+		};
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** One request: its status, or undefined when it never answered. */
+async function probe(url, signal) {
+	try {
+		const response = await fetch(url, { signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) });
+		response.body?.cancel().catch(() => {});
+		return response.status;
+	} catch {
+		signal.throwIfAborted();
+		return;
+	}
 }
 /**
-* Prepare secrets for multiple apps.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedApps - Map of app name to sniffed environment
-* @returns Map of app name to encrypted secrets
-*/
-function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
-	const results = /* @__PURE__ */ new Map();
-	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
-		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
-		results.set(appName, encrypted);
+* Check `url` until it answers 2xx `healthyAfter` times in a row, emitting
+* `health.checked` for every check.
+*
+* @throws {HealthCheckTimedOut} when that has not happened within `timeoutMs`.
+*/
+async function verifyHealth(check) {
+	const { app, url, healthyAfter, intervalMs, timeoutMs, signal, emit } = check;
+	const deadline = Date.now() + timeoutMs;
+	let consecutive = 0;
+	let attempt = 0;
+	while (true) {
+		attempt++;
+		const status = await probe(url, signal);
+		const healthy = status !== void 0 && status >= 200 && status < 300;
+		emit({
+			type: "health.checked",
+			app,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		consecutive = healthy ? consecutive + 1 : 0;
+		if (consecutive >= healthyAfter) return;
+		if (Date.now() + intervalMs > deadline) throw new HealthCheckTimedOut(app, url, timeoutMs, status);
+		await sleep(intervalMs, signal);
 	}
-	return results;
 }
+/** The migrations of a deployed stage failed; the release stopped before any app. */
+var DeployMigrationsFailed = class extends Error {
+	stage;
+	reason;
+	constructor(stage, reason, message) {
+		super(`Migrating "${stage}" failed, so no app was released: ${message}. Migrations applied before the failing one stay applied; fix it and deploy again.`);
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "DeployMigrationsFailed";
+	}
+};
 /**
-* Generate a report on secrets preparation.
-*/
-function generateSecretsReport(encryptedApps, sniffedApps) {
-	const appsWithSecrets = [];
-	const appsWithoutSecrets = [];
-	const appsWithMissingSecrets = [];
-	for (const [appName, sniffedEnv] of sniffedApps) {
-		if (sniffedEnv.requiredEnvVars.length === 0) {
-			appsWithoutSecrets.push(appName);
-			continue;
-		}
-		const encrypted = encryptedApps.get(appName);
-		if (encrypted) {
-			appsWithSecrets.push(appName);
-			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
-				appName,
-				missing: encrypted.missingSecrets
+* The URLs a stage's migrations connect with, keyed as the migrator reads
+* them, grouped by the database their cluster serves — for the targets that
+* have a migration to apply. Empty when none does, so a deploy publishes
+* nothing for a project that has not written one.
+*/
+async function migrationUrls(root, manifest, env) {
+	const byDatabase = /* @__PURE__ */ new Map();
+	for (const target of migrationTargets(manifest)) {
+		if ((await migrationFiles(join(root, target.migrations))).size === 0) continue;
+		for (const role of ["ownerUrl", "url"]) {
+			const key = provideKey(target.id, role);
+			const url = env[key];
+			if (!url) continue;
+			const database = new URL(url).pathname.slice(1);
+			byDatabase.set(database, {
+				...byDatabase.get(database),
+				[key]: url
 			});
 		}
 	}
-	return {
-		totalApps: sniffedApps.size,
-		appsWithSecrets: appsWithSecrets.sort(),
-		appsWithoutSecrets: appsWithoutSecrets.sort(),
-		appsWithMissingSecrets
-	};
+	return byDatabase;
+}
+const answer = discriminatedUnion("reason", [object({
+	reason: literal("migrated"),
+	runs: array(object({
+		migrations: string(),
+		applied: array(string())
+	}))
+}), object({
+	reason: literal("failed"),
+	error: looseObject({
+		name: string(),
+		message: string()
+	})
+})]);
+/** Apply every pending migration, in the sandbox, as each construct's owner. */
+async function runMigrations(options) {
+	const sandbox = options.sandbox ?? activeSandbox() ?? new LocalSandbox({ root: options.root });
+	const { value } = await runWorker(sandbox, "migrations", {
+		name: "migrate-worker",
+		args: [JSON.stringify({
+			root: options.root,
+			manifest: options.manifest,
+			patterns: options.patterns
+		})],
+		cwd: options.root,
+		timeoutMs: options.timeoutMs ?? 9e5,
+		secrets: options.urls,
+		signal: options.signal,
+		schema: answer
+	});
+	if (value.reason === "failed") throw new DeployMigrationsFailed(options.stage, value.error.name, value.error.message);
+	return value.runs;
 }
 //#endregion
-//#region src/deploy/index.ts
+//#region src/target/dokploy/postgres.ts
 /**
-* Deploy Module
-*
-* Handles deployment of GKM workspaces to various providers (Docker, Dokploy).
+* Reaching a Dokploy Postgres from where the deploy runs.
 *
-* ## Per-App Database Credentials
-*
-* When deploying to Dokploy with Postgres, this module creates per-app database
-* users with isolated schemas. This follows the same pattern as local dev mode
-* (docker/postgres/init.sh).
-*
-* ### How It Works
-*
-* 1. **Provisioning**: Creates Postgres service with master credentials
-* 2. **User Creation**: For each backend app that needs DATABASE_URL:
-*    - Generates a unique password (stored in deploy state)
-*    - Creates a database user with that password
-*    - Assigns schema permissions based on app name
-* 3. **Schema Assignment**:
-*    - `api` app: Uses `public` schema (shared tables)
-*    - Other apps (e.g., `auth`): Get their own schema with `search_path` set
-* 4. **Environment Injection**: Each app receives its own DATABASE_URL
-*
-* ### Security
-*
-* - External Postgres port is enabled only during user creation, then disabled
-* - Each app can only access its own schema
-* - Credentials are stored in `.gkm/deploy-{stage}.json` (gitignored)
-* - Subsequent deploys reuse existing credentials from state
-*
-* ### Example Flow
-*
-* ```
-* gkm deploy --stage production
-*   ├─ Create Postgres (user: postgres, db: myproject)
-*   ├─ Enable external port temporarily
-*   ├─ Create user "api" → public schema
-*   ├─ Create user "auth" → auth schema (search_path=auth)
-*   ├─ Disable external port
-*   ├─ Deploy "api" with DATABASE_URL=postgresql://api:xxx@postgres:5432/myproject
-*   └─ Deploy "auth" with DATABASE_URL=postgresql://auth:yyy@postgres:5432/myproject
-* ```
-*
-* @module deploy
+* A Dokploy Postgres answers on the server's Docker network and nowhere else:
+* its address is its service name, which only another container there
+* resolves. Two steps of a deploy need it from outside — the role DDL the
+* provisioners defer, and the migrations `release` applies — so the cluster
+* is published on an external port for exactly as long as they take, and
+* closed again whatever happens.
 */
-const logger = output;
+const logger$1 = output;
+/** A Postgres published for the role DDL never accepted a connection. */
+var PostgresNotReady = class extends Error {
+	host;
+	port;
+	attempts;
+	constructor(host, port, attempts) {
+		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
+		this.host = host;
+		this.port = port;
+		this.attempts = attempts;
+		this.name = "PostgresNotReady";
+	}
+};
+/** No port could be published for a cluster, so its DDL cannot reach it. */
+var PostgresPortUnavailable = class extends Error {
+	appName;
+	taken;
+	constructor(appName, taken) {
+		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
+		this.appName = appName;
+		this.taken = taken;
+		this.name = "PostgresPortUnavailable";
+	}
+};
 /**
 * Wait for Postgres to be ready to accept connections.
 *
@@ -1772,14 +1902,7 @@ const logger = output;
 * Used after enabling the external port to ensure the database is accessible
 * before creating users.
 *
-* @param host - The Postgres server hostname
-* @param port - The external port (typically 5432)
-* @param user - Master database user (postgres)
-* @param password - Master database password
-* @param database - Database name to connect to
-* @param maxRetries - Maximum number of connection attempts (default: 30)
-* @param retryIntervalMs - Milliseconds between retries (default: 2000)
-* @throws Error if Postgres is not ready after maxRetries
+* @throws {PostgresNotReady} if Postgres is not ready after maxRetries
 */
 async function waitForPostgres(host, port, user, password, database, maxRetries = 30, retryIntervalMs = 2e3) {
 	for (let i = 0; i < maxRetries; i++) try {
@@ -1797,49 +1920,12 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 		return;
 	} catch {
 		if (i < maxRetries - 1) {
-			logger.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			logger$1.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
 			await new Promise((r) => setTimeout(r, retryIntervalMs));
 		}
 	}
 	throw new PostgresNotReady(host, port, maxRetries);
 }
-/** A Postgres published for the role DDL never accepted a connection. */
-var PostgresNotReady = class extends Error {
-	host;
-	port;
-	attempts;
-	constructor(host, port, attempts) {
-		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
-		this.host = host;
-		this.port = port;
-		this.attempts = attempts;
-		this.name = "PostgresNotReady";
-	}
-};
-/** No port could be published for a cluster, so its DDL cannot reach it. */
-var PostgresPortUnavailable = class extends Error {
-	appName;
-	taken;
-	constructor(appName, taken) {
-		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
-		this.appName = appName;
-		this.taken = taken;
-		this.name = "PostgresPortUnavailable";
-	}
-};
-/**
-* Run the manifest's DDL against a Dokploy Postgres.
-*
-* The cluster is only reachable from outside while an external port is
-* published, so this opens one, applies, and leaves it as it found it. The
-* alternative — running DDL from inside the network — needs a container to run
-* it in, which is what `DatabaseBootstrap` is on AWS and what a Dokploy target
-* has no equivalent for yet.
-*
-* The applier is the local target's, so every statement asks whether it is
-* needed first: a redeploy is free, and a half-applied run recovers by being
-* run again.
-*/
 /**
 * A high port for one service, the same one every time.
 *
@@ -1852,32 +1938,80 @@ function derivedPort(appName) {
 	const digest = createHash("sha256").update(appName).digest();
 	return 49152 + (digest[0] << 8 | digest[1]) % 16e3;
 }
-async function applyDeclaredStatements(api, postgres, serverHostname, statements) {
-	let externalPort = await api.getPostgres(postgres.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
+/** The hostname of the Dokploy server, from its API endpoint. */
+function serverHostname(endpoint) {
+	return new URL(endpoint).hostname;
+}
+/**
+* Publish `cluster` on an external port of the server at `host`, and wait
+* until it accepts a connection there.
+*/
+async function publishPostgres(api, cluster, host) {
+	let externalPort = await api.getPostgres(cluster.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
 	const opened = externalPort === void 0;
 	if (externalPort === void 0) {
 		const taken = await api.publishedPorts().catch(() => /* @__PURE__ */ new Set());
-		const candidates = [5432, derivedPort(postgres.appName)].filter((port) => !taken.has(port));
+		const candidates = [5432, derivedPort(cluster.appName)].filter((port) => !taken.has(port));
 		for (const candidate of candidates) try {
-			await api.savePostgresExternalPort(postgres.postgresId, candidate);
+			await api.savePostgresExternalPort(cluster.postgresId, candidate);
 			externalPort = candidate;
 			break;
 		} catch (error) {
 			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
-			logger.log(`   Port ${candidate} is taken; trying another...`);
+			logger$1.log(`   Port ${candidate} is taken; trying another...`);
 		}
-		if (externalPort === void 0) throw new PostgresPortUnavailable(postgres.appName, [...taken]);
-		logger.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
+		if (externalPort === void 0) throw new PostgresPortUnavailable(cluster.appName, [...taken]);
+		logger$1.log(`   Publishing ${cluster.appName} on ${externalPort}...`);
+	}
+	const port = externalPort;
+	let closed = false;
+	const close = async () => {
+		if (!opened || closed) return;
+		closed = true;
+		await api.savePostgresExternalPort(cluster.postgresId, null).then(() => api.deployPostgres(cluster.postgresId)).catch(() => {
+			logger$1.log(`   ⚠ Could not close external port ${port} on ${cluster.appName} — close it in Dokploy.`);
+		});
+	};
+	try {
+		await api.deployPostgres(cluster.postgresId);
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName);
+	} catch (error) {
+		await close();
+		throw error;
 	}
-	await api.deployPostgres(postgres.postgresId);
-	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
+	return {
+		cluster,
+		host,
+		port,
+		close
+	};
+}
+/**
+* A URL the cluster's containers use — its service name, its internal port —
+* pointed at where `published` answers from here instead.
+*/
+function publishedUrl(url, published) {
+	const parsed = new URL(url);
+	parsed.hostname = published.host;
+	parsed.port = String(published.port);
+	return parsed.toString();
+}
+/**
+* Run the manifest's DDL against a published Dokploy Postgres.
+*
+* The applier is the local target's, so every statement asks whether it is
+* needed first: a redeploy is free, and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclaredStatements(published, statements) {
+	const { cluster, host, port } = published;
 	const client = { async query(database, sql, values) {
 		const connection = new Client({
-			host: serverHostname,
-			port: externalPort,
-			user: postgres.databaseUser,
-			password: postgres.databasePassword,
-			database: database ?? postgres.databaseName,
+			host,
+			port,
+			user: cluster.databaseUser,
+			password: cluster.databasePassword,
+			database: database ?? cluster.databaseName,
 			connectionTimeoutMillis: 15e3
 		});
 		connection.on("error", () => {});
@@ -1888,35 +2022,22 @@ async function applyDeclaredStatements(api, postgres, serverHostname, statements
 			await connection.end();
 		}
 	} };
-	const unpublish = async () => {
-		if (!opened) return;
-		await api.savePostgresExternalPort(postgres.postgresId, null).then(() => api.deployPostgres(postgres.postgresId)).catch(() => {
-			logger.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
-		});
-	};
 	let lastError;
-	try {
-		for (let attempt = 1; attempt <= 3; attempt++) try {
-			return await applyDeclared(client, statements);
-		} catch (error) {
-			lastError = error;
-			if (attempt === 3) break;
-			const message = error instanceof Error ? error.message : String(error);
-			logger.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
-			await new Promise((resolve) => setTimeout(resolve, 1e4));
-			await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName).catch(() => {});
-		}
-		throw lastError;
-	} finally {
-		await unpublish();
+	for (let attempt = 1; attempt <= 3; attempt++) try {
+		return await applyDeclared(client, statements);
+	} catch (error) {
+		lastError = error;
+		if (attempt === 3) break;
+		const message = error instanceof Error ? error.message : String(error);
+		logger$1.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+		await new Promise((resolve) => setTimeout(resolve, 1e4));
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName).catch(() => {});
 	}
+	throw lastError;
 }
-/**
-* Get the server hostname from the Dokploy endpoint URL
-*/
-function getServerHostname(endpoint) {
-	return new URL(endpoint).hostname;
-}
+//#endregion
+//#region src/target/dokploy/engine.ts
+const logger = output;
 /**
 * The variables an app cannot start without.
 *
@@ -1944,6 +2065,19 @@ var BackendDeployFailed = class extends Error {
 		this.name = "BackendDeployFailed";
 	}
 };
+/**
+* Sites failed to release or to answer. Every site is attempted before this
+* is thrown, so one broken site does not keep the others back — but the run
+* fails, and what failed is rolled back.
+*/
+var FrontendDeployFailed = class extends Error {
+	apps;
+	constructor(apps, cause) {
+		super(`Frontend deployment failed for ${apps.join(", ")}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.apps = apps;
+		this.name = "FrontendDeployFailed";
+	}
+};
 /** An app's environment needs values the stage does not have. */
 var MissingEnvVars = class extends Error {
 	app;
@@ -1972,6 +2106,16 @@ const CHILD_STDIO = {
 	],
 	ignore: "ignore"
 };
+/** The defaults of `deploy.dokploy.verify`. */
+function verifySettings(config) {
+	return {
+		deploymentTimeoutMs: config?.deploymentTimeoutMs ?? 6e5,
+		healthCheckPath: config?.healthCheckPath ?? "/health",
+		healthyAfter: config?.healthyAfter ?? 3,
+		intervalMs: config?.intervalMs ?? 2e3,
+		healthTimeoutMs: config?.healthTimeoutMs ?? 3e5
+	};
+}
 /**
 * Deploy every app in a workspace to Dokploy: the engine under the built-in
 * `dokploy` target.
@@ -2022,7 +2166,14 @@ async function validateDokploy(phase) {
 	};
 	return {
 		...run,
-		preflight: await preflight(run)
+		preflight: await preflight(run),
+		verify: verifySettings(workspace.deploy.dokploy?.verify),
+		atomic: phase.atomic,
+		releasing: {
+			switched: /* @__PURE__ */ new Map(),
+			failed: /* @__PURE__ */ new Set()
+		},
+		published: /* @__PURE__ */ new Map()
 	};
 }
 /**
@@ -2060,6 +2211,19 @@ async function preflight({ workspace, manifest, stage, secrets: secretsStore, ct
 * before it is created, so a run stopped part way is finished by the next.
 */
 async function provisionDokploy(run) {
+	try {
+		await provision(run);
+	} catch (error) {
+		await closePublished(run);
+		throw error;
+	}
+}
+/** Unpublish every cluster the run still has published. */
+async function closePublished(run) {
+	for (const published of run.published.values()) await published.close();
+	run.published.clear();
+}
+async function provision(run) {
 	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
 	const { stageSecrets } = run.preflight;
 	const changes = [];
@@ -2163,6 +2327,7 @@ async function provisionDokploy(run) {
 	if (skippedMobileApps.length > 0) logger.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	let declaredEnv = {};
 	let declaredClusters = {};
+	let migrations = /* @__PURE__ */ new Map();
 	{
 		logger.log("\n📦 Provisioning declared constructs...");
 		const appUrls = {};
@@ -2185,20 +2350,25 @@ async function provisionDokploy(run) {
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
 		if (Object.keys(declaredEnv).length > 0) logger.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
-		if (declared.statements.length > 0) {
-			const serverHostname = getServerHostname(endpoint);
-			for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
-				const statements = declared.statements.filter((statement) => statement.database === databaseName);
-				if (statements.length === 0) continue;
-				const created = await applyDeclaredStatements(api, cluster, serverHostname, statements);
-				logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+		migrations = await migrationUrls(workspace.root, manifest, declaredEnv);
+		const host = serverHostname(endpoint);
+		for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
+			const statements = declared.statements.filter((statement) => statement.database === databaseName);
+			if (statements.length === 0) continue;
+			const published = await publishPostgres(api, cluster, host);
+			run.published.set(databaseName, published);
+			const created = await applyDeclaredStatements(published, statements);
+			if (!migrations.has(databaseName)) {
+				await published.close();
+				run.published.delete(databaseName);
 			}
+			logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
 		}
 	}
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
 		logger.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-DIVCbfee.mjs");
+		const { provisionBackupDestination } = await import("./backup-provisioner-C8DnCmxK.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -2236,14 +2406,22 @@ async function provisionDokploy(run) {
 		registry,
 		registryId,
 		declaredEnv,
+		declaredClusters,
+		migrations,
 		changes,
 		applied
 	};
 }
 /**
-* Each app's image built and pushed, its application configured and
-* deployed, and its domain attached: backends first, each failure stopping
-* the run; then sites, whose build args are the backends' public URLs.
+* The stage's migrations, then each app's image built and pushed, its
+* application configured and deployed, and its domain attached — counted as
+* released only once Dokploy's deployment has finished.
+*
+* Backends first, each failure stopping the run; then they are checked, and
+* a backend that does not answer stops the run too — a site built against an
+* API that is down is a site that is down. Then the sites, whose build args
+* are the backends' public URLs: every one is attempted, and any that failed
+* fails the run. `verify` checks the sites.
 *
 * Building is here rather than in a `build` phase of its own because an
 * image is built beside its application — a site's build args are resolved
@@ -2254,12 +2432,25 @@ async function releaseDokploy(run) {
 	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
 	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
 	const project = { projectId: run.provisioned.projectId };
+	try {
+		await migrate(run);
+	} finally {
+		await closePublished(run);
+	}
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const publicUrls = {};
 	const results = [];
 	const appHostnames = /* @__PURE__ */ new Map();
 	const appDomainIds = /* @__PURE__ */ new Map();
+	const released = {
+		results,
+		publicUrls,
+		appHostnames,
+		appDomainIds,
+		applicationIds: /* @__PURE__ */ new Map()
+	};
+	run.released = released;
 	/** An app is up: say so, and remember where. */
 	const deployed = (appName, result, host) => {
 		const url = `https://${host}`;
@@ -2276,29 +2467,8 @@ async function releaseDokploy(run) {
 			url
 		});
 	};
-	/** An app failed: say so, and record it in the result. */
-	const failed = (appName, app, error) => {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
-		results.push({
-			appName,
-			type: app.type,
-			success: false,
-			error: message
-		});
-		ctx.emit({
-			type: "app.failed",
-			app: appName,
-			error: eventError(error)
-		});
-	};
 	/** An image is pushed: worth keeping even if what follows fails. */
-	const built = async (appName, image, ref) => {
-		setDeployedImage(state, appName, {
-			ref: image.imageRef ?? ref,
-			...image.digest ? { digest: image.digest } : {}
-		});
-		await journal.save();
+	const built = (appName, image, ref) => {
 		ctx.emit({
 			type: "artifact.built",
 			app: appName,
@@ -2312,6 +2482,41 @@ async function releaseDokploy(run) {
 			id: image.digest ?? image.imageRef ?? ref
 		});
 	};
+	/**
+	* Point an app's application at its image and environment, deploy it,
+	* attach its domain, and wait for Dokploy to finish — then record the
+	* release, with what ran before it as the one a rollback restores.
+	*/
+	const release = async (appName, applicationId, image, envVars, host) => {
+		const app = workspace.apps[appName];
+		released.applicationIds.set(appName, applicationId);
+		const since = await api.latestDeploymentAt(applicationId);
+		const before = state.releases?.[appName]?.current;
+		run.releasing.switched.set(appName, {
+			applicationId,
+			...before ? { before } : {}
+		});
+		await api.saveDockerProvider(applicationId, image.ref, { registryId });
+		await api.saveApplicationEnv(applicationId, envVars.join("\n"));
+		logger.log(`      Deploying to Dokploy...`);
+		await api.deployApplication(applicationId);
+		const domainId = await ensureDomain(api, journal, host, app.port, applicationId, applied);
+		appHostnames.set(appName, host);
+		if (domainId) appDomainIds.set(appName, domainId);
+		logger.log(`      Waiting for the deployment to finish...`);
+		await api.waitForDeployment(applicationId, {
+			since,
+			timeoutMs: run.verify.deploymentTimeoutMs,
+			intervalMs: run.verify.intervalMs,
+			signal: ctx.signal
+		});
+		recordRelease(state, appName, {
+			...image,
+			tag: imageTag
+		});
+		await journal.save();
+		publicUrls[appName] = `https://${host}`;
+	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
 	if (backendApps.length > 0) {
@@ -2342,7 +2547,7 @@ async function releaseDokploy(run) {
 					credentials,
 					...dockerRun(workspace, app, ctx)
 				});
-				await built(appName, image, imageRef$1);
+				built(appName, image, imageRef$1);
 				const backendHost = hostOf(workspace, appName, stage);
 				const dependencyUrls = {};
 				if (app.dependencies) {
@@ -2373,14 +2578,10 @@ async function releaseDokploy(run) {
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
 				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
-				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
-				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger.log(`      Deploying to Dokploy...`);
-				await api.deployApplication(application.applicationId);
-				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId, applied);
-				appHostnames.set(appName, backendHost);
-				if (domainId) appDomainIds.set(appName, domainId);
-				publicUrls[appName] = `https://${backendHost}`;
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, backendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
@@ -2391,11 +2592,20 @@ async function releaseDokploy(run) {
 				logger.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				if (ctx.signal?.aborted) throw ctx.signal.reason;
-				failed(appName, app, error);
+				failed(run, appName, error);
 				throw new BackendDeployFailed(appName, error);
 			}
 		}
+		await settleDns(run, backendApps);
+		for (const appName of backendApps) try {
+			await checkHealth(run, appName);
+		} catch (error) {
+			if (ctx.signal?.aborted) throw ctx.signal.reason;
+			failed(run, appName, error);
+			throw new BackendDeployFailed(appName, error);
+		}
 	}
+	let frontendFailure;
 	if (frontendApps.length > 0) {
 		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
 		for (const appName of frontendApps) {
@@ -2447,21 +2657,17 @@ async function releaseDokploy(run) {
 					publicUrlArgs: publicUrlArgNames,
 					...dockerRun(workspace, app, ctx)
 				});
-				await built(appName, image, imageRef$2);
+				built(appName, image, imageRef$2);
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
 					`STAGE=${stage}`
 				];
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
-				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
-				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger.log(`      Deploying to Dokploy...`);
-				await api.deployApplication(application.applicationId);
-				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId, applied);
-				appHostnames.set(appName, frontendHost);
-				if (domainId) appDomainIds.set(appName, domainId);
-				publicUrls[appName] = `https://${frontendHost}`;
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, frontendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
@@ -2472,42 +2678,199 @@ async function releaseDokploy(run) {
 				logger.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				if (ctx.signal?.aborted) throw ctx.signal.reason;
-				failed(appName, app, error);
+				failed(run, appName, error);
+				frontendFailure ??= error;
 			}
 		}
 	}
 	logger.log("\n📋 Saving deploy state...");
 	await journal.save();
 	logger.log("   ✓ State saved");
-	run.released = {
-		results,
-		publicUrls,
-		appHostnames
-	};
+	if (frontendFailure !== void 0) throw new FrontendDeployFailed(frontendApps.filter((app) => run.releasing.failed.has(app)), frontendFailure);
 }
-/** DNS records for each released app, and Dokploy's validation of each domain. */
+/** Each released site answering, after its DNS. Backends were checked in `release`. */
 async function verifyDokploy(run) {
+	const { workspace, ctx } = run;
+	const sites = run.released.results.filter((result) => result.success).map((result) => result.appName).filter((app) => workspace.apps[app]?.type === "web");
+	if (sites.length === 0) return;
+	await settleDns(run, sites);
+	let failure;
+	for (const appName of sites) try {
+		await checkHealth(run, appName);
+	} catch (error) {
+		if (ctx.signal.aborted) throw ctx.signal.reason;
+		failed(run, appName, error);
+		failure ??= error;
+	}
+	if (failure !== void 0) throw new FrontendDeployFailed(sites.filter((app) => run.releasing.failed.has(app)), failure);
+}
+/**
+* An app failed to release or to answer: say so, mark it for rollback, and
+* record it in the result — over the success it was recorded as, if its
+* health is what failed.
+*/
+function failed(run, appName, error) {
+	const app = run.workspace.apps[appName];
+	const message = error instanceof Error ? error.message : "Unknown error";
+	logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+	const results = run.released.results;
+	const recorded = results.find((result) => result.appName === appName);
+	if (recorded) {
+		recorded.success = false;
+		recorded.error = message;
+	} else results.push({
+		appName,
+		type: app.type,
+		success: false,
+		error: message
+	});
+	run.releasing.failed.add(appName);
+	run.ctx.emit({
+		type: "app.failed",
+		app: appName,
+		error: eventError(error)
+	});
+}
+/**
+* The stage's pending migrations, applied in the deploy's sandbox against
+* each cluster published for them. Nothing is published, and nothing runs,
+* for a project with no migration to apply.
+*/
+async function migrate(run) {
+	const { workspace, manifest, stage, ctx } = run;
+	const { api, endpoint, migrations, declaredClusters } = run.provisioned;
+	if (migrations.size === 0) return;
+	logger.log("\n🗄️  Applying migrations...");
+	const host = serverHostname(endpoint);
+	const urls = {};
+	for (const [database, keys] of migrations) {
+		const cluster = declaredClusters[database];
+		if (!cluster) continue;
+		let published = run.published.get(database);
+		if (!published) {
+			published = await publishPostgres(api, cluster, host);
+			run.published.set(database, published);
+		}
+		for (const [key, url] of Object.entries(keys)) urls[key] = publishedUrl(url, published);
+	}
+	const runs = await runMigrations({
+		root: workspace.root,
+		stage,
+		manifest,
+		patterns: constructGlobs(workspace),
+		urls,
+		signal: ctx.signal
+	});
+	for (const { migrations: folder, applied } of runs) logger.log(applied.length === 0 ? `   ✓ ${folder}: up to date` : `   ✓ ${folder}: applied ${applied.join(", ")}`);
+}
+/**
+* DNS records for `apps`' hosts, their propagation, and Dokploy's validation
+* of each domain — before anything is asked of them by name.
+*/
+async function settleDns(run, apps) {
 	const { workspace } = run;
 	const { api, endpoint, journal, state } = run.provisioned;
-	const { appHostnames } = run.released;
+	const appHostnames = new Map([...run.released.appHostnames].filter(([app]) => apps.includes(app)));
 	const dnsConfig = workspace.deploy.dns;
-	if (dnsConfig && appHostnames.size > 0) {
-		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
-		if (dnsResult?.serverIp && appHostnames.size > 0) {
-			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
-			await journal.save();
+	if (!dnsConfig || appHostnames.size === 0) return;
+	const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
+	if (dnsResult?.serverIp) {
+		await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
+		await journal.save();
+	}
+	if (dnsResult?.success) {
+		logger.log("\n🔒 Validating domains for SSL certificates...");
+		for (const [appName, hostname] of appHostnames) try {
+			const result = await api.validateDomain(hostname);
+			if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+			else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
+		} catch (validationError) {
+			const message = validationError instanceof Error ? validationError.message : "Unknown error";
+			logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
 		}
-		if (dnsResult?.success && appHostnames.size > 0) {
-			logger.log("\n🔒 Validating domains for SSL certificates...");
-			for (const [appName, hostname] of appHostnames) try {
-				const result = await api.validateDomain(hostname);
-				if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
-				else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
-			} catch (validationError) {
-				const message = validationError instanceof Error ? validationError.message : "Unknown error";
-				logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
-			}
+	}
+}
+/**
+* Whether a released app answers: `healthyAfter` 2xx in a row from its
+* health route under its domain. An app without a domain has nothing to ask
+* by name, so Dokploy's finished deployment is its check.
+*/
+async function checkHealth(run, appName) {
+	const { workspace, verify, ctx } = run;
+	const { appHostnames, appDomainIds, applicationIds } = run.released;
+	const host = appHostnames.get(appName);
+	if (!host || !appDomainIds.has(appName)) {
+		ctx.emit({
+			type: "health.checked",
+			app: appName,
+			url: `dokploy:application.status/${applicationIds.get(appName)}`,
+			healthy: true,
+			attempt: 1
+		});
+		logger.log(`   ✓ ${appName}: no domain, so its finished deployment is its check`);
+		return;
+	}
+	const url = `https://${host}${workspace.apps[appName].type === "web" ? "/" : verify.healthCheckPath}`;
+	logger.log(`\n🩺 Checking ${appName} at ${url}...`);
+	await verifyHealth({
+		app: appName,
+		url,
+		healthyAfter: verify.healthyAfter,
+		intervalMs: verify.intervalMs,
+		timeoutMs: verify.healthTimeoutMs,
+		signal: ctx.signal,
+		emit: ctx.emit
+	});
+	logger.log(`   ✓ ${appName} healthy (${verify.healthyAfter} in a row)`);
+}
+/**
+* Point an application back at `image`, deploy it, and wait for Dokploy to
+* finish. The environment stays the newer release's: it is resolved from the
+* stage, which a rollback does not change, and holds no image of its own.
+*/
+async function restoreImage(api, options) {
+	const { applicationId, image, registryId, verify, signal } = options;
+	const since = await api.latestDeploymentAt(applicationId);
+	await api.saveDockerProvider(applicationId, image.ref, registryId ? { registryId } : void 0);
+	await api.deployApplication(applicationId);
+	await api.waitForDeployment(applicationId, {
+		since,
+		timeoutMs: verify.deploymentTimeoutMs,
+		intervalMs: verify.intervalMs,
+		signal
+	});
+}
+/**
+* Put back what ran before this run, after its `release` or `verify` failed:
+* the apps that failed — or, `atomic`, every app the run released — each
+* pointed at its previous image and redeployed. An app released for the
+* first time has nothing to go back to and is left as it is.
+*/
+async function rollbackDokploy(run, failure) {
+	const { switched, failed: failedApps } = run.releasing;
+	const apps = [...switched.keys()].filter((app) => run.atomic || failedApps.has(app));
+	if (!run.provisioned || apps.length === 0) {
+		logger.log(`\n⏪ Nothing to roll back: the ${failure.phase} failed before any app was switched.`);
+		return;
+	}
+	const { api, journal, state, registryId } = run.provisioned;
+	logger.log(`\n⏪ Rolling back ${run.atomic ? "every app this run released" : "what failed"}: ${apps.join(", ")}`);
+	for (const appName of apps) {
+		const { applicationId, before } = switched.get(appName);
+		if (!before) {
+			logger.log(`   ⚠ ${appName}: this was its first release, so there is nothing to restore`);
+			continue;
 		}
+		await restoreImage(api, {
+			applicationId,
+			image: before,
+			registryId,
+			verify: run.verify,
+			signal: run.ctx.signal
+		});
+		recordRollback(state, appName, before);
+		await journal.save();
+		logger.log(`   ✓ ${appName} rolled back to ${before.ref}`);
 	}
 }
 /** What the run did, printed as the summary it always ended with. */
@@ -2624,10 +2987,14 @@ async function ensureDomain(api, journal, host, port, applicationId, applied) {
 function isAbort(error) {
 	return error instanceof Error && error.name === "AbortError";
 }
-/** Where docker runs for one app: in the app's own directory. */
+/**
+* Where docker runs for one app: the workspace root, building from the
+* Dockerfile `gkm docker` writes for the app there.
+*/
 function dockerRun(workspace, app, ctx) {
 	return {
-		cwd: resolve(workspace.root, app.path),
+		cwd: workspace.root,
+		appPath: app.path,
 		...ctx.signal ? { signal: ctx.signal } : {},
 		...ctx.stdio ? { stdio: ctx.stdio } : {}
 	};
@@ -2794,6 +3161,6 @@ async function planDokploy(run) {
 /** Why a mobile app is left out of a Dokploy deploy. */
 const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
-export { provisionDokploy as a, verifyDokploy as c, RegistryNotFound as d, ProjectNotOwned as f, planDokploy as i, RegistryAmbiguous as l, MissingEnvVars as n, releaseDokploy as o, dokployResult as r, validateDokploy as s, BackendDeployFailed as t, RegistryNotConfigured as u };
+export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=deploy-CZ5nlpsu.mjs.map
+//# sourceMappingURL=engine-CunvOG3s.mjs.map