@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/{deploy-CZ5nlpsu.mjs → engine-Gs0abjuj.mjs}

@@ -1,134 +1,440 @@
-import { S as keyFingerprint, b as encryptSecrets, f as StateStoreBusy, i as DokployApiError, m as StateVersionConflict, r as DokployApi, t as sniffAllApps, v as eventError } from "./sniffer-BZ-OJO4Y.mjs";
-import { c as runOutput, s as run } from "./local-CWR4Y_kW.mjs";
-import { t as MissingCredential } from "./credentials-Dq1MnWQf.mjs";
-import { d as output, r as discover } from "./discover-LMrqsWSU.mjs";
+import { i as LocalSandbox, t as MissingCredential } from "./credentials-pAtB70k3.mjs";
+import { a as discriminatedUnion, d as string, l as object, n as array, o as literal, s as looseObject } from "./schemas-Cfhtpdo0.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-BFoJWKGD.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-C06_pW4g.mjs";
-import "./config.mjs";
-import { i as toEmbeddableSecrets, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, p as isOwnedBy } from "./store-CLiHnqOY.mjs";
-import { C as isMainFrontendApp, D as constructGlobs, J as providerOf, K as cacheBackendFor, N as applyPostgres, S as validateImageRef, W as resourceName, Y as storageBackendFor, _ as dockerCommand, a as setApplicationId, c as setDnsRecord, d as setPostgresBackupId, f as DeployJournal, h as DockerPushFailed, i as isDnsVerified, l as setDnsVerification, m as DockerBuildFailed, n as getBackupState, o as setBackupState, p as withGeneratedSecrets, q as eventsBackendFor, r as getGeneratedSecret, s as setDeployedImage, t as createEmptyState, u as setGeneratedSecret, w as resolveHost } from "./state-B8YwmUZU.mjs";
-import "./terminal-CfbiYUbZ.mjs";
-import { join, resolve } from "node:path";
-import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
+import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-Be6uBhlF.mjs";
+import { $ as cacheBackendFor, At as projectName, C as resolveHost, Ct as applicationName, Dt as isOwnedBy, Et as imageRef, F as applyPostgres, K as resourceName, Ot as markerOf, Pt as toEmbeddableSecrets, S as isMainFrontendApp, Tt as imageName, _ as deployDocker, a as recordRelease, c as setBackupState, d as setGeneratedSecret, et as eventsBackendFor, f as setPostgresBackupId, i as isDnsVerified, jt as initStageSecrets, k as constructGlobs, kt as ownershipMarker, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, nt as storageBackendFor, o as recordRollback, p as DeployJournal, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, tt as providerOf, u as setDnsVerification, w as encryptSecrets } from "./state-DkUStoqJ.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-BdFeLSmA.mjs";
+import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
+import { join } from "node:path";
+import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
-//#region src/deploy/fromManifest.ts
+//#region src/deploy/ownership.ts
 /**
-* The Dokploy target, read off the construct manifest.
-*
-* The AWS target has done this since `fromManifest` landed: a table keyed by
-* declaration kind, each entry turning one declaration into infrastructure and
-* the env keys it resolves. Dokploy had no such thing — it resolved environment
-* from the *sniffer*, which walks application code for `get('X')` calls, and a
-* construct reads its own key inside `@geekmidas/constructs` where there is
-* nothing to find. So a declared app deployed here got none of the model, and
-* nothing reported the absence: the deploy succeeded and the first request that
-* needed a URL failed at runtime.
-*
-* This is the same table, over the REST wrapper instead of over Pulumi.
+* Which Dokploy project a deploy is allowed to deploy into.
 *
-* **Two phases, and the split is not incidental.** Creating a Postgres and
-* creating a role inside it are different kinds of act: the first is an API
-* call, the second needs a connection to a database that does not exist yet
-* when the call is made. So provisioners *accumulate* DDL rather than running
-* it, and it is applied once against a cluster that is up — which is exactly
-* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
+*/
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The project this identity owns, if there is one — read only, so a dry run
+* asks the same question a deploy does:
 *
-* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
-* the same generators the local target and the AWS target use. Dokploy used to
-* write its own `DO $$` block, which meant three targets applying three
-* different definitions of "the role split" and no way to notice they had
-* drifted.
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project.
+* 2. One with this name *and* this identity's marker.
 *
-* Entries are deliberately small and free of I/O ordering: each takes what it
-* needs and returns what it resolved. That is what would let a Pulumi dynamic
-* provider wrap one later without the table itself changing — see §6b.
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
 */
+async function findProject(api, identity, stateProjectId) {
+	const name = projectName(identity);
+	const marker = ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				description: known.description ?? null,
+				environments: known.environments ?? [],
+				via: "state",
+				needsClaim: !claimed
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			description: owned.description ?? null,
+			environments: details.environments ?? [],
+			via: "marker",
+			needsClaim: false
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	return null;
+}
 /**
-* The internal hostname a Dokploy Postgres answers on.
-*
-* Its own service name on the Docker network — not the server's public address.
-* An app reaching its database over the public internet would be a credential
-* crossing a network that did not need to see it.
+* The project this deploy deploys into: the one {@link findProject} finds —
+* claimed with this identity's marker if it carries none yet, so the next
+* deploy without state still finds it — or a new one, marked.
 */
-function clusterHost(postgres) {
-	return postgres.appName;
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const marker = ownershipMarker(identity);
+	const found = await findProject(api, identity, stateProjectId);
+	if (found) {
+		if (found.needsClaim) {
+			await api.updateProject(found.projectId, {
+				name: found.name,
+				description: withMarker(found.description, marker)
+			});
+			log(`   Claimed project ${found.name} for ${identity.key}`);
+		}
+		return {
+			projectId: found.projectId,
+			name: found.name,
+			environments: found.environments,
+			via: found.via
+		};
+	}
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(projectName(identity), withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
 }
+//#endregion
+//#region src/deploy/registry.ts
 /**
-* What a resource is called in the provider.
-*
-* `cloudName` and nothing else — the same scoped kebab rule the AWS target
-* uses, so a name reads identically on both: `production-shop-orders`.
+* Which Dokploy registry a stage's images are pulled through.
 *
-* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
-* is one flat list where an application and its database would collide. It is
-* not: `project.one` returns typed collections — `applications`, `postgres`,
-* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
-* the shape of the response and an application and a Postgres of the same name
-* are different objects with different ids. The suffix was answering a question
-* nobody had asked.
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
 */
-function serviceName(scope, id) {
-	return cloudName(scope, id);
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		this.stage = stage;
+		this.name = "RegistryNotConfigured";
+	}
+};
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
+	}
+};
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
+	}
+};
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
 }
-const PROVISIONERS = {
-	/**
-	* A Postgres service, plus the roles that reach it.
-	*
-	* The service is `findOrCreate`, because a deploy that recreated the
-	* database would be a deploy that lost the data. The roles are deferred:
-	* they need a connection to a cluster this call has only just asked for.
-	*/
-	database: async (declaration, context) => {
-		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
-		const name = resourceName(declaration.id, declaration.kind, context.stage);
-		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
-			stage: context.stage,
-			app: context.scope ?? context.project
-		}, declaration.id), context.projectId, context.environmentId, {
-			databaseName: name,
-			databasePassword: derivedPassword(context, `${name}:master`)
-		});
-		const host = clusterHost(postgres);
-		context.clusters[postgres.databaseName] = postgres;
-		const schema = declaration.schema ?? "app";
-		const runtime = name;
-		const owner = ownerRole(runtime);
-		const reads = readsFrom(context.manifest, declaration.id);
-		context.deferred.push(...statementsFor({
-			id: declaration.id,
-			database: postgres.databaseName,
-			ownsDatabase: true,
-			runtime,
-			owner,
-			...reads ? { reader: readerRole(runtime) } : {},
-			schema,
-			context
-		}));
-		return { provides: {
-			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
-			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
-		} };
-	},
-	/**
-	* A schema in the parent's database, with its own role and its own URL — so
-	* the parent's role holds no grant on these tables at all.
-	*/
-	"database-schema": async (declaration, context) => {
-		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
-		const parent = context.provisioned[declaration.of];
-		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const runtime = resourceName(declaration.id, declaration.kind, context.stage);
-		const owner = ownerRole(runtime);
-		const reads = readsFrom(context.manifest, declaration.id);
-		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
-		context.deferred.push(...statementsFor({
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
+	}
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
+//#region src/deploy/secrets.ts
+/**
+* Filter secrets to only include the env vars that an app requires.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Filtered secrets with found/missing tracking
+*/
+function filterSecretsForApp(stageSecrets, sniffedEnv) {
+	const allSecrets = toEmbeddableSecrets(stageSecrets);
+	const filtered = {};
+	const found = [];
+	const missing = [];
+	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
+		filtered[key] = allSecrets[key];
+		found.push(key);
+	} else missing.push(key);
+	return {
+		appName: sniffedEnv.appName,
+		secrets: filtered,
+		found: found.sort(),
+		missing: missing.sort()
+	};
+}
+/**
+* Encrypt filtered secrets for an app.
+* Generates an ephemeral master key that should be injected into Dokploy.
+*
+* @param filteredSecrets - The filtered secrets for the app
+* @returns Encrypted payload with master key
+*/
+function encryptSecretsForApp(filteredSecrets) {
+	const payload = encryptSecrets(filteredSecrets.secrets);
+	return {
+		appName: filteredSecrets.appName,
+		payload,
+		masterKey: payload.masterKey,
+		secretCount: Object.keys(filteredSecrets.secrets).length,
+		missingSecrets: filteredSecrets.missing
+	};
+}
+/**
+* Filter and encrypt secrets for an app in one step.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
+* @returns Encrypted secrets with master key
+*/
+function prepareSecretsForApp(stageSecrets, sniffedEnv) {
+	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+}
+/**
+* Prepare secrets for multiple apps.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedApps - Map of app name to sniffed environment
+* @returns Map of app name to encrypted secrets
+*/
+function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
+		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
+		results.set(appName, encrypted);
+	}
+	return results;
+}
+/**
+* Generate a report on secrets preparation.
+*/
+function generateSecretsReport(encryptedApps, sniffedApps) {
+	const appsWithSecrets = [];
+	const appsWithoutSecrets = [];
+	const appsWithMissingSecrets = [];
+	for (const [appName, sniffedEnv] of sniffedApps) {
+		if (sniffedEnv.requiredEnvVars.length === 0) {
+			appsWithoutSecrets.push(appName);
+			continue;
+		}
+		const encrypted = encryptedApps.get(appName);
+		if (encrypted) {
+			appsWithSecrets.push(appName);
+			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
+				appName,
+				missing: encrypted.missingSecrets
+			});
+		}
+	}
+	return {
+		totalApps: sniffedApps.size,
+		appsWithSecrets: appsWithSecrets.sort(),
+		appsWithoutSecrets: appsWithoutSecrets.sort(),
+		appsWithMissingSecrets
+	};
+}
+//#endregion
+//#region src/target/dokploy/fromManifest.ts
+/**
+* The Dokploy target, read off the construct manifest.
+*
+* The AWS target has done this since `fromManifest` landed: a table keyed by
+* declaration kind, each entry turning one declaration into infrastructure and
+* the env keys it resolves. Dokploy had no such thing — it resolved environment
+* from the *sniffer*, which walks application code for `get('X')` calls, and a
+* construct reads its own key inside `@geekmidas/constructs` where there is
+* nothing to find. So a declared app deployed here got none of the model, and
+* nothing reported the absence: the deploy succeeded and the first request that
+* needed a URL failed at runtime.
+*
+* This is the same table, over the REST wrapper instead of over Pulumi.
+*
+* **Two phases, and the split is not incidental.** Creating a Postgres and
+* creating a role inside it are different kinds of act: the first is an API
+* call, the second needs a connection to a database that does not exist yet
+* when the call is made. So provisioners *accumulate* DDL rather than running
+* it, and it is applied once against a cluster that is up — which is exactly
+* what `DatabaseBootstrap` does on AWS, for exactly the same reason.
+*
+* **The DDL itself is shared.** `roleStatements` and `cacheTableStatements` are
+* the same generators the local target and the AWS target use. Dokploy used to
+* write its own `DO $$` block, which meant three targets applying three
+* different definitions of "the role split" and no way to notice they had
+* drifted.
+*
+* Entries are deliberately small and free of I/O ordering: each takes what it
+* needs and returns what it resolved. That is what would let a Pulumi dynamic
+* provider wrap one later without the table itself changing — see §6b.
+*/
+/**
+* The internal hostname a Dokploy Postgres answers on.
+*
+* Its own service name on the Docker network — not the server's public address.
+* An app reaching its database over the public internet would be a credential
+* crossing a network that did not need to see it.
+*/
+function clusterHost(postgres) {
+	return postgres.appName;
+}
+/**
+* What a resource is called in the provider.
+*
+* `cloudName` and nothing else — the same scoped kebab rule the AWS target
+* uses, so a name reads identically on both: `production-shop-orders`.
+*
+* It briefly carried a `-postgres` suffix on the theory that a Dokploy project
+* is one flat list where an application and its database would collide. It is
+* not: `project.one` returns typed collections — `applications`, `postgres`,
+* `redis`, `compose`, `mariadb`, `mongo`, `mysql` — so the kind is already in
+* the shape of the response and an application and a Postgres of the same name
+* are different objects with different ids. The suffix was answering a question
+* nobody had asked.
+*/
+function serviceName(scope, id) {
+	return cloudName(scope, id);
+}
+const PROVISIONERS = {
+	/**
+	* A Postgres service, plus the roles that reach it.
+	*
+	* The service is `findOrCreate`, because a deploy that recreated the
+	* database would be a deploy that lost the data. The roles are deferred:
+	* they need a connection to a cluster this call has only just asked for.
+	*/
+	database: async (declaration, context) => {
+		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
+		const name = resourceName(declaration.id, declaration.kind, context.stage);
+		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id), context.projectId, context.environmentId, {
+			databaseName: name,
+			databasePassword: derivedPassword(context, `${name}:master`)
+		});
+		const host = clusterHost(postgres);
+		context.clusters[postgres.databaseName] = postgres;
+		const schema = declaration.schema ?? "app";
+		const runtime = name;
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		context.deferred.push(...statementsFor({
+			id: declaration.id,
+			database: postgres.databaseName,
+			ownsDatabase: true,
+			runtime,
+			owner,
+			...reads ? { reader: readerRole(runtime) } : {},
+			schema,
+			context
+		}));
+		return { provides: {
+			[provideKey(declaration.id, "url")]: postgresUrl(runtime, derivedPassword(context, runtime), host, postgres.databaseName),
+			[provideKey(declaration.id, "ownerUrl")]: postgresUrl(owner, derivedPassword(context, owner), host, postgres.databaseName)
+		} };
+	},
+	/**
+	* A schema in the parent's database, with its own role and its own URL — so
+	* the parent's role holds no grant on these tables at all.
+	*/
+	"database-schema": async (declaration, context) => {
+		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
+		const parent = context.provisioned[declaration.of];
+		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
+		const runtime = resourceName(declaration.id, declaration.kind, context.stage);
+		const owner = ownerRole(runtime);
+		const reads = readsFrom(context.manifest, declaration.id);
+		const parentUrl = new URL(parent.provides[provideKey(declaration.of, "url")] ?? "");
+		context.deferred.push(...statementsFor({
 			id: declaration.id,
 			database: parentUrl.pathname.slice(1),
 			runtime,
@@ -647,7 +953,7 @@ var UnprovisionableBucket = class extends Error {
 	}
 };
 //#endregion
-//#region src/deploy/declared.ts
+//#region src/target/dokploy/declared.ts
 /**
 * The declared half of a Dokploy deploy.
 *
@@ -676,1095 +982,741 @@ async function provisionDeclared(options) {
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root
 	});
-	if (Object.keys(manifest).length === 0) return empty;
-	const context = {
-		manifest,
-		provisioned: {},
-		api: options.api,
-		projectId: options.projectId,
-		environmentId: options.environmentId,
-		stage: options.stage,
-		project: workspace.name,
-		scope: options.scope ?? workspace.name,
-		cache: cacheBackendFor(providerOf(workspace)),
-		events: eventsBackendFor(providerOf(workspace)),
-		storage: storageBackendFor(providerOf(workspace)),
-		addresses: surfaceAddresses(manifest, options.appUrls),
-		seed: options.seed,
-		...options.supplied ? { supplied: options.supplied } : {},
-		deferred: [],
-		clusters: {}
-	};
-	const env = {};
-	for (const id of carriersLast(provisionOrder(manifest), manifest)) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const provisioner = provisionerFor(declaration.kind);
-		if (!provisioner) continue;
-		const result = await provisioner(declaration, context);
-		context.provisioned[id] = result;
-		Object.assign(env, result.provides);
-	}
-	return {
-		env,
-		statements: context.deferred.map((statement) => ({
-			id: statement.id,
-			describe: statement.describe,
-			...statement.database ? { database: statement.database } : {},
-			...statement.exists ? { exists: statement.exists } : {},
-			create: statement.sql
-		})),
-		provisioned: context.provisioned,
-		clusters: context.clusters
-	};
-}
-/**
-* Run the deferred DDL against a cluster that is now reachable.
-*
-* The same applier the local target uses: every statement asks whether it is
-* needed first, so a redeploy is free and a half-applied run recovers by being
-* run again.
-*/
-async function applyDeclared(client, statements) {
-	return (await applyPostgres(client, statements)).filter((entry) => entry.created).length;
-}
-/**
-* The provisioning order, with queues and topics moved to the end.
-*
-* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
-* *derived from* a database, because under SNS it does not live in one. Where
-* it lives is a fact about the backend, which is config — so the dependency is
-* real under pg-boss and absent under SNS, and writing it into the declaration
-* would state it in the one place that cannot know.
-*
-* Here it can. This runs where the backend is known, and the rule needs no
-* branch on it: nothing depends on a carrier. A queue's worker and a topic's
-* subscribers are *bound* to it rather than dependent on it, which is why
-* neither holds a key of its own — so a carrier can always go last, and under
-* pg-boss that is exactly late enough for the database it reads to be there.
-*/
-function carriersLast(ordered, manifest) {
-	const carries = (id) => {
-		const kind = manifest[id]?.kind;
-		return kind === "queue" || kind === "topic";
-	};
-	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
-}
-/**
-* Where each declared surface answers: its own app's address.
-*
-* Every surface is an app of its own, keyed by its id the way the derivation
-* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
-* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
-* address, so a workspace with two APIs pointed both at the same one.
-*/
-function surfaceAddresses(manifest, appUrls) {
-	const addresses = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api") continue;
-		const url = appUrls[appKey(id)];
-		if (url) addresses[id] = url;
-	}
-	return addresses;
-}
-//#endregion
-//#region src/deploy/dns/DnsProvider.ts
-/**
-* Check if value is a DnsProvider implementation.
-*/
-function isDnsProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
-}
-/**
-* Create a DNS provider based on configuration.
-*
-* - 'hostinger': HostingerProvider
-* - 'route53': Route53Provider
-* - 'manual': Returns null (user handles DNS)
-* - Custom: Use provided DnsProvider implementation
-*/
-async function createDnsProvider(options) {
-	const { config } = options;
-	if (config.provider === "manual") return null;
-	if (isDnsProvider(config.provider)) return config.provider;
-	const provider = config.provider;
-	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-x9gQTAGZ.mjs");
-		return new HostingerProvider();
-	}
-	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-Cvj40A8I.mjs");
-		const route53Config = config;
-		return new Route53Provider({
-			region: route53Config.region,
-			profile: route53Config.profile,
-			hostedZoneId: route53Config.hostedZoneId
-		});
-	}
-	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
-	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
-}
-//#endregion
-//#region src/deploy/dns/index.ts
-/**
-* DNS orchestration for deployments
-*
-* Handles automatic DNS record creation for deployed applications.
-*/
-const logger$2 = output;
-/**
-* Check if DNS config is legacy format (single domain with `domain` property)
-*/
-function isLegacyDnsConfig(config) {
-	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
-}
-/**
-* Normalize DNS config to new multi-domain format
-*/
-function normalizeDnsConfig(config) {
-	if (isLegacyDnsConfig(config)) {
-		const { domain, ...providerConfig } = config;
-		return { [domain]: providerConfig };
-	}
-	return config;
-}
-/**
-* Find the root domain for a hostname from available DNS configs
-*
-* @example
-* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
-* // Returns 'geekmidas.com'
-*/
-function findRootDomain(hostname, dnsConfig) {
-	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
-	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
-	return null;
-}
-/**
-* Group hostnames by their root domain
-*/
-function groupHostnamesByDomain(appHostnames, dnsConfig) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const [appName, hostname] of appHostnames) {
-		const rootDomain = findRootDomain(hostname, dnsConfig);
-		if (!rootDomain) {
-			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
-			continue;
-		}
-		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
-		grouped.get(rootDomain).set(appName, hostname);
-	}
-	return grouped;
-}
-/**
-* Resolve IP address from a hostname
-*/
-async function resolveHostnameToIp(hostname) {
-	try {
-		return (await lookup(hostname, { family: 4 })).address;
-	} catch (error) {
-		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
-	}
-}
-/**
-* Extract subdomain from full hostname relative to root domain
-*
-* @example
-* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
-* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
-*/
-function extractSubdomain(hostname, rootDomain) {
-	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
-	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
-}
-/**
-* Generate required DNS records for a deployment
-*/
-function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
-	const records = [];
-	for (const [appName, hostname] of appHostnames) {
-		const subdomain = extractSubdomain(hostname, rootDomain);
-		records.push({
-			hostname,
-			subdomain,
-			type: "A",
-			value: serverIp,
-			appName
-		});
-	}
-	return records;
-}
-/**
-* Print DNS records table
-*/
-function printDnsRecordsTable(records, rootDomain) {
-	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
-	for (const record of records) {
-		const subdomain = record.subdomain.padEnd(35);
-		const type = record.type.padEnd(4);
-		const value = record.value.padEnd(15);
-		let status;
-		if (record.error) status = "✗";
-		else if (record.created) status = "✓ new";
-		else if (record.existed) status = "✓";
-		else status = "?";
-		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
-	}
-	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
-}
-/**
-* Print DNS records in a simple format for manual setup
-*/
-function printDnsRecordsSimple(records, rootDomain) {
-	logger$2.log("\n   📋 Required DNS Records:");
-	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$2.log("");
-}
-/**
-* Create DNS records for a single domain using its configured provider
-*/
-async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
-	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
-	let provider;
-	try {
-		provider = await createDnsProvider({ config: providerConfig });
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			...r,
-			error: message
-		}));
-	}
-	if (!provider) return records.map((r) => ({
-		...r,
-		created: false,
-		existed: false
-	}));
-	const results = [];
-	const upsertRecords = records.map((r) => ({
-		name: r.subdomain,
-		type: r.type,
-		ttl,
-		value: r.value
-	}));
-	try {
-		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
-		for (const [i, record] of records.entries()) {
-			const result = upsertResults[i];
-			if (!result) {
-				results.push({
-					hostname: record.hostname,
-					subdomain: record.subdomain,
-					type: record.type,
-					value: record.value,
-					appName: record.appName,
-					error: "No result returned from provider"
-				});
-				continue;
-			}
-			if (result.unchanged) results.push({
-				hostname: record.hostname,
-				subdomain: record.subdomain,
-				type: record.type,
-				value: record.value,
-				appName: record.appName,
-				existed: true,
-				created: false
-			});
-			else results.push({
-				hostname: record.hostname,
-				subdomain: record.subdomain,
-				type: record.type,
-				value: record.value,
-				appName: record.appName,
-				created: result.created,
-				existed: !result.created
-			});
-		}
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			hostname: r.hostname,
-			subdomain: r.subdomain,
-			type: r.type,
-			value: r.value,
-			appName: r.appName,
-			error: message
-		}));
-	}
-	return results;
-}
-/**
-* Main DNS orchestration function for deployments
-*
-* Supports both legacy single-domain format and new multi-domain format:
-* - Legacy: { provider: 'hostinger', domain: 'example.com' }
-* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
-*
-* @param appHostnames - Map of app names to hostnames
-* @param dnsConfig - DNS configuration (legacy or multi-domain)
-* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
-* @param state - Optional state to save created records for later deletion
-*/
-async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
-	if (!dnsConfig) return null;
-	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$2.log("\n🌐 Setting up DNS records...");
-	let serverIp;
-	try {
-		const endpointUrl = new URL(dokployEndpoint);
-		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
-		return null;
-	}
-	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
-	if (groupedHostnames.size === 0) {
-		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
-		return {
-			records: [],
-			success: true,
-			serverIp
-		};
-	}
-	const allRecords = [];
-	let hasFailures = false;
-	for (const [rootDomain, domainHostnames] of groupedHostnames) {
-		const providerConfig = normalizedConfig[rootDomain];
-		if (!providerConfig) {
-			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
-			continue;
-		}
-		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
-		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
-		if (requiredRecords.length === 0) continue;
-		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
-		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
-		allRecords.push(...domainRecords);
-		const created = domainRecords.filter((r) => r.created).length;
-		const existed = domainRecords.filter((r) => r.existed).length;
-		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
-		if (failed > 0) {
-			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
-			hasFailures = true;
-		}
-		if (state) {
-			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
-				domain: rootDomain,
-				name: record.subdomain,
-				type: record.type,
-				value: record.value,
-				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
-			});
-		}
-		printDnsRecordsTable(domainRecords, rootDomain);
-		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
-	}
-	return {
-		records: allRecords,
-		success: !hasFailures,
-		serverIp
-	};
-}
-/**
-* Verify DNS records resolve correctly after deployment.
-*
-* This function:
-* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
-* 2. Attempts to resolve each hostname to an IP
-* 3. Compares resolved IP with expected server IP
-* 4. Updates state with verification results
-*
-* @param appHostnames - Map of app names to hostnames
-* @param serverIp - Expected IP address the hostnames should resolve to
-* @param state - Deploy state for caching verification results
-* @returns Array of verification results
-*/
-async function verifyDnsRecords(appHostnames, serverIp, state) {
-	const results = [];
-	logger$2.log("\n🔍 Verifying DNS records...");
-	for (const [appName, hostname] of appHostnames) {
-		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$2.log(`   ✓ ${hostname} (previously verified)`);
-			results.push({
-				hostname,
-				appName,
-				verified: true,
-				expectedIp: serverIp,
-				skipped: true
-			});
-			continue;
-		}
-		try {
-			const resolvedIp = await resolveHostnameToIp(hostname);
-			if (resolvedIp === serverIp) {
-				setDnsVerification(state, hostname, serverIp);
-				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
-				results.push({
-					hostname,
-					appName,
-					verified: true,
-					resolvedIp,
-					expectedIp: serverIp
-				});
-			} else {
-				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
-				results.push({
-					hostname,
-					appName,
-					verified: false,
-					resolvedIp,
-					expectedIp: serverIp
-				});
-			}
-		} catch (error) {
-			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
-			results.push({
-				hostname,
-				appName,
-				verified: false,
-				expectedIp: serverIp,
-				error: message
-			});
-		}
+	if (Object.keys(manifest).length === 0) return empty;
+	const context = {
+		manifest,
+		provisioned: {},
+		api: options.api,
+		projectId: options.projectId,
+		environmentId: options.environmentId,
+		stage: options.stage,
+		project: workspace.name,
+		scope: options.scope ?? workspace.name,
+		cache: cacheBackendFor(providerOf(workspace)),
+		events: eventsBackendFor(providerOf(workspace)),
+		storage: storageBackendFor(providerOf(workspace)),
+		addresses: surfaceAddresses(manifest, options.appUrls),
+		seed: options.seed,
+		...options.supplied ? { supplied: options.supplied } : {},
+		deferred: [],
+		clusters: {}
+	};
+	const env = {};
+	for (const id of carriersLast(provisionOrder(manifest), manifest)) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const provisioner = provisionerFor(declaration.kind);
+		if (!provisioner) continue;
+		const result = await provisioner(declaration, context);
+		context.provisioned[id] = result;
+		Object.assign(env, result.provides);
 	}
-	const verified = results.filter((r) => r.verified).length;
-	const skipped = results.filter((r) => r.skipped).length;
-	const pending = results.filter((r) => !r.verified).length;
-	if (pending > 0) {
-		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
-	return results;
+	return {
+		env,
+		statements: context.deferred.map((statement) => ({
+			id: statement.id,
+			describe: statement.describe,
+			...statement.database ? { database: statement.database } : {},
+			...statement.exists ? { exists: statement.exists } : {},
+			create: statement.sql
+		})),
+		provisioned: context.provisioned,
+		clusters: context.clusters
+	};
 }
-//#endregion
-//#region src/deploy/docker.ts
-const logger$1 = output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
 /**
-* Get the full image reference
+* Run the deferred DDL against a cluster that is now reachable.
+*
+* The same applier the local target uses: every statement asks whether it is
+* needed first, so a redeploy is free and a half-applied run recovers by being
+* run again.
 */
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
+async function applyDeclared(client, statements) {
+	return (await applyPostgres(client, statements)).filter((entry) => entry.created).length;
 }
 /**
-* The `docker build` argv for an image.
+* The provisioning order, with queues and topics moved to the end.
 *
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
+* `provisionOrder` walks `of` edges, and a carrier has none: a topic is not
+* *derived from* a database, because under SNS it does not live in one. Where
+* it lives is a fact about the backend, which is config — so the dependency is
+* real under pg-boss and absent under SNS, and writing it into the declaration
+* would state it in the one place that cannot know.
 *
-* @internal Exported for testing
+* Here it can. This runs where the backend is known, and the rule needs no
+* branch on it: nothing depends on a carrier. A queue's worker and a topic's
+* subscribers are *bound* to it rather than dependent on it, which is why
+* neither holds a key of its own — so a carrier can always go last, and under
+* pg-boss that is exactly late enough for the database it reads to be there.
 */
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
+function carriersLast(ordered, manifest) {
+	const carries = (id) => {
+		const kind = manifest[id]?.kind;
+		return kind === "queue" || kind === "topic";
+	};
+	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
 }
 /**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
+* Where each declared surface answers: its own app's address.
 *
-* @internal Exported for testing
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
 */
-async function writeCredentialsFile(credentials) {
-	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
-	const path = join(dir, CREDENTIALS_SECRET_ID);
-	await writeFile(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
-	await chmod(path, 384);
-	return {
-		path,
-		cleanup: () => rm(dir, {
-			recursive: true,
-			force: true
-		})
-	};
+function surfaceAddresses(manifest, appUrls) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[appKey(id)];
+		if (url) addresses[id] = url;
+	}
+	return addresses;
 }
+//#endregion
+//#region src/target/dokploy/dns/DnsProvider.ts
 /**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
+* Check if value is a DnsProvider implementation.
 */
-async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
-	logger$1.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$1.log("   Generating Dockerfile for the pre-built bundle...");
-	await dockerCommand({
-		slim: true,
-		cwd
-	});
-	const dockerfilePath = join(cwd, ".gkm", "docker", "Dockerfile");
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs,
-			credentialsFile: secret?.path
-		}), {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$1.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
 }
 /**
-* Push Docker image to registry
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
 */
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await import("./HostingerProvider-D85ayzTi.mjs");
+		return new HostingerProvider();
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await import("./Route53Provider-QXxjkZO1.mjs");
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
 		});
-		logger$1.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
 	}
+	if (provider === "cloudflare") throw new Error("Cloudflare DNS provider not yet implemented");
+	throw new Error(`Unknown DNS provider: ${JSON.stringify(config)}`);
 }
+//#endregion
+//#region src/target/dokploy/dns/index.ts
 /**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
+* DNS orchestration for deployments
 *
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+* Handles automatic DNS record creation for deployed applications.
+*/
+const logger$2 = output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
 }
 /**
-* Deploy using Docker (build and optionally push image)
+* Normalize DNS config to new multi-domain format
 */
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const docker = {
-		cwd: options.cwd ?? process.cwd(),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger$1.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
 	}
-	logger$1.log("\n✅ Docker deployment ready!");
-	logger$1.log(`\n📋 Deployment details:`);
-	logger$1.log(`   Image: ${imageRef}`);
-	logger$1.log(`   Stage: ${stage}`);
-	if (masterKey) logger$1.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	return config;
 }
-//#endregion
-//#region src/deploy/env-resolver.ts
 /**
-* Environment Variable Resolution for Dokploy Deployments
+* Find the root domain for a hostname from available DNS configs
 *
-* Resolves sniffed environment variables to actual values during deployment.
-* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
-* and falls back to user-provided secrets.
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
 */
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
+}
 /**
-* Generate a secure random secret (64 hex characters = 32 bytes)
+* Group hostnames by their root domain
 */
-function generateSecret() {
-	return randomBytes(32).toString("hex");
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
+	}
+	return grouped;
 }
 /**
-* Get or generate a secret for an app.
-* If the secret already exists in state, returns it.
-* Otherwise generates a new one and stores it.
+* Resolve IP address from a hostname
 */
-function getOrGenerateSecret(state, appName, secretName) {
-	const existing = getGeneratedSecret(state, appName, secretName);
-	if (existing) return existing;
-	const generated = generateSecret();
-	setGeneratedSecret(state, appName, secretName, generated);
-	return generated;
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await lookup(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
 }
 /**
-* Resolve a single environment variable
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
 */
-function resolveEnvVar(varName, context) {
-	switch (varName) {
-		case "PORT": return String(context.app.port);
-		case "NODE_ENV": return "production";
-		case "STAGE": return context.stage;
-		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
-		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
-		case "BETTER_AUTH_TRUSTED_ORIGINS":
-			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
-			break;
-		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
-	}
-	if (context.dependencyUrls && varName.endsWith("_URL")) {
-		const depName = (stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
-		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
-	}
-	if (context.userSecrets) {
-		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
-		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
-		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
-		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
-	}
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
 }
 /**
-* Resolve all environment variables for an app
+* Generate required DNS records for a deployment
 */
-function resolveEnvVars(requiredVars, context) {
-	const resolved = {};
-	const missing = [];
-	for (const varName of requiredVars) {
-		const value = resolveEnvVar(varName, context);
-		if (value !== void 0) resolved[varName] = value;
-		else missing.push(varName);
-	}
-	return {
-		resolved,
-		missing
-	};
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
 }
 /**
-* Format missing variables error message
+* Print DNS records table
 */
-function formatMissingVarsError(appName, missing, stage) {
-	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+function printDnsRecordsTable(records, rootDomain) {
+	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+	}
+	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
-* Validate that all required environment variables can be resolved
+* Print DNS records in a simple format for manual setup
 */
-function validateEnvVars(requiredVars, context) {
-	const { resolved, missing } = resolveEnvVars(requiredVars, context);
-	return {
-		valid: missing.length === 0,
-		missing,
-		resolved
-	};
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$2.log("\n   📋 Required DNS Records:");
+	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$2.log("");
 }
-//#endregion
-//#region src/deploy/ownership.ts
-/**
-* Which Dokploy project a deploy is allowed to deploy into.
-*
-* Deploy used to take any project whose name matched the workspace's, in any
-* case — so a second workspace called `shop` (or `Shop`) on the same server
-* deployed into the first one's project, over its images and applications. A
-* project is now claimed by an ownership marker in its description, and a
-* project with the right name and no marker is somebody else's.
-*/
 /**
-* A Dokploy project with the name this deploy would use exists, and nothing
-* says this workspace created it.
+* Create DNS records for a single domain using its configured provider
 */
-var ProjectNotOwned = class extends Error {
-	projectName;
-	projectId;
-	identity;
-	ownedBy;
-	constructor(projectName, projectId, identity, ownedBy) {
-		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
-		this.projectName = projectName;
-		this.projectId = projectId;
-		this.identity = identity;
-		this.ownedBy = ownedBy;
-		this.name = "ProjectNotOwned";
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
 	}
-};
-/** A description with the marker added, keeping what was there. */
-function withMarker(description, marker) {
-	const existing = (description ?? "").trim();
-	return existing ? `${existing}\n${marker}` : marker;
-}
-/** `project.one`, or `null` when Dokploy no longer has the project. */
-async function projectById(api, projectId) {
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
 	try {
-		return await api.getProject(projectId) ?? null;
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
 	} catch (error) {
-		if (error instanceof DokployApiError) return null;
-		throw error;
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
 	}
+	return results;
 }
 /**
-* The project this identity owns, if there is one — read only, so a dry run
-* asks the same question a deploy does:
+* Main DNS orchestration function for deployments
 *
-* 1. The one the stage's state names, if Dokploy still has it. State written
-*    before markers existed is trusted — it holds an id this workspace was
-*    given when it created the project.
-* 2. One with this name *and* this identity's marker.
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
 *
-* A project that matches by name (in any case) but carries no marker, or
-* another identity's, raises `ProjectNotOwned` — it is never adopted.
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
 */
-async function findProject(api, identity, stateProjectId) {
-	const name = projectName(identity);
-	const marker = ownershipMarker(identity);
-	if (stateProjectId) {
-		const known = await projectById(api, stateProjectId);
-		if (known) {
-			const claimed = markerOf(known.description);
-			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
-			return {
-				projectId: known.projectId,
-				name: known.name,
-				description: known.description ?? null,
-				environments: known.environments ?? [],
-				via: "state",
-				needsClaim: !claimed
-			};
-		}
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$2.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
 	}
-	const projects = await api.listProjects();
-	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
-	if (owned) {
-		const details = await api.getProject(owned.projectId);
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
-			projectId: owned.projectId,
-			name: owned.name,
-			description: owned.description ?? null,
-			environments: details.environments ?? [],
-			via: "marker",
-			needsClaim: false
+			records: [],
+			success: true,
+			serverIp
 		};
 	}
-	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
-	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
-	return null;
-}
-/**
-* The project this deploy deploys into: the one {@link findProject} finds —
-* claimed with this identity's marker if it carries none yet, so the next
-* deploy without state still finds it — or a new one, marked.
-*/
-async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
-	const marker = ownershipMarker(identity);
-	const found = await findProject(api, identity, stateProjectId);
-	if (found) {
-		if (found.needsClaim) {
-			await api.updateProject(found.projectId, {
-				name: found.name,
-				description: withMarker(found.description, marker)
-			});
-			log(`   Claimed project ${found.name} for ${identity.key}`);
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
 		}
-		return {
-			projectId: found.projectId,
-			name: found.name,
-			environments: found.environments,
-			via: found.via
-		};
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
 	}
-	await hooks.beforeCreate?.();
-	const created = await api.createProject(projectName(identity), withMarker("Deployed by gkm.", marker));
 	return {
-		projectId: created.project.projectId,
-		name: created.project.name,
-		environments: [created.environment],
-		via: "created"
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
 	};
 }
-//#endregion
-//#region src/deploy/registry.ts
 /**
-* Which Dokploy registry a stage's images are pulled through.
+* Verify DNS records resolve correctly after deployment.
 *
-* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
-* when that was empty, the first registry Dokploy listed — so an image could be
-* deployed with credentials for a registry nobody chose, and two workspaces
-* deployed from one machine shared whichever was stored last. The id is now
-* kept in the stage's state, and found only from what the workspace
-* configured.
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
 */
-/** There is nowhere to push images to, so Dokploy has nothing to pull. */
-var RegistryNotConfigured = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
-		this.stage = stage;
-		this.name = "RegistryNotConfigured";
-	}
-};
-/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
-var RegistryNotFound = class extends Error {
-	registryId;
-	constructor(registryId) {
-		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
-		this.registryId = registryId;
-		this.name = "RegistryNotFound";
-	}
-};
-/** More than one Dokploy registry serves the configured registry. */
-var RegistryAmbiguous = class extends Error {
-	registry;
-	registryIds;
-	constructor(registry, registryIds) {
-		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
-		this.registry = registry;
-		this.registryIds = registryIds;
-		this.name = "RegistryAmbiguous";
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$2.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (isDnsVerified(state, hostname, serverIp)) {
+			logger$2.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				setDnsVerification(state, hostname, serverIp);
+				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
+			});
+		}
 	}
-};
-/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
-function parts(url) {
-	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
-	return {
-		host,
-		path: path.join("/")
-	};
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
 }
+//#endregion
+//#region src/target/dokploy/env-resolver.ts
 /**
-* The Dokploy registries that serve `registry`: the same host, and — where
-* Dokploy's own entry names one — the same path.
+* Environment Variable Resolution for Dokploy Deployments
+*
+* Resolves sniffed environment variables to actual values during deployment.
+* Auto-supports common variables like DATABASE_URL, REDIS_URL, BETTER_AUTH_*,
+* and falls back to user-provided secrets.
 */
-function serving(registries, registry) {
-	const wanted = parts(registry);
-	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
-	if (sameHost.length <= 1) return sameHost;
-	return sameHost.filter((r) => {
-		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
-	});
+/**
+* Generate a secure random secret (64 hex characters = 32 bytes)
+*/
+function generateSecret() {
+	return randomBytes(32).toString("hex");
 }
-/** `registry.one`, or `null` when Dokploy says it has no such registry. */
-async function registryById(api, registryId) {
-	try {
-		return await api.getRegistry(registryId) ?? null;
-	} catch (error) {
-		if (error instanceof DokployApiError) return null;
-		throw error;
-	}
+/**
+* Get or generate a secret for an app.
+* If the secret already exists in state, returns it.
+* Otherwise generates a new one and stores it.
+*/
+function getOrGenerateSecret(state, appName, secretName) {
+	const existing = getGeneratedSecret(state, appName, secretName);
+	if (existing) return existing;
+	const generated = generateSecret();
+	setGeneratedSecret(state, appName, secretName, generated);
+	return generated;
 }
 /**
-* The registry id for a stage, in order: the configured id, the one in the
-* stage's state, the one Dokploy has for the configured registry URL, and
-* otherwise a new one. Never a registry the workspace did not point at.
+* Resolve a single environment variable
 */
-async function resolveRegistry(api, options) {
-	const { stage, registry, configuredId, stateId, log = () => {} } = options;
-	if (!registry) throw new RegistryNotConfigured(stage);
-	if (configuredId) {
-		const configured = await registryById(api, configuredId);
-		if (!configured) throw new RegistryNotFound(configuredId);
-		return configured;
+function resolveEnvVar(varName, context) {
+	switch (varName) {
+		case "PORT": return String(context.app.port);
+		case "NODE_ENV": return "production";
+		case "STAGE": return context.stage;
+		case "BETTER_AUTH_URL": return `https://${context.appHostname}`;
+		case "BETTER_AUTH_SECRET": return getOrGenerateSecret(context.state, context.appName, "BETTER_AUTH_SECRET");
+		case "BETTER_AUTH_TRUSTED_ORIGINS":
+			if (context.frontendUrls.length > 0) return context.frontendUrls.join(",");
+			break;
+		case "GKM_MASTER_KEY": if (context.masterKey) return context.masterKey;
 	}
-	if (stateId) {
-		const known = await registryById(api, stateId);
-		if (known) return known;
-		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	if (context.dependencyUrls && varName.endsWith("_URL")) {
+		const depName = (stripPublicPrefix(varName) ?? varName).slice(0, -4).toLowerCase();
+		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
+	}
+	if (context.userSecrets) {
+		if (context.userSecrets.custom[varName]) return context.userSecrets.custom[varName];
+		if (varName in context.userSecrets.urls) return context.userSecrets.urls[varName];
+		if (varName === "POSTGRES_PASSWORD" && context.userSecrets.services.postgres) return context.userSecrets.services.postgres.password;
+		if (varName === "REDIS_PASSWORD" && context.userSecrets.services.redis) return context.userSecrets.services.redis.password;
 	}
-	const matches = serving(await api.listRegistries(), registry);
-	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
-	if (matches[0]) return matches[0];
-	return options.create(registry);
 }
-//#endregion
-//#region src/deploy/secrets.ts
 /**
-* Filter secrets to only include the env vars that an app requires.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
-* @returns Filtered secrets with found/missing tracking
+* Resolve all environment variables for an app
 */
-function filterSecretsForApp(stageSecrets, sniffedEnv) {
-	const allSecrets = toEmbeddableSecrets(stageSecrets);
-	const filtered = {};
-	const found = [];
+function resolveEnvVars(requiredVars, context) {
+	const resolved = {};
 	const missing = [];
-	for (const key of sniffedEnv.requiredEnvVars) if (key in allSecrets) {
-		filtered[key] = allSecrets[key];
-		found.push(key);
-	} else missing.push(key);
+	for (const varName of requiredVars) {
+		const value = resolveEnvVar(varName, context);
+		if (value !== void 0) resolved[varName] = value;
+		else missing.push(varName);
+	}
 	return {
-		appName: sniffedEnv.appName,
-		secrets: filtered,
-		found: found.sort(),
-		missing: missing.sort()
+		resolved,
+		missing
 	};
 }
 /**
-* Encrypt filtered secrets for an app.
-* Generates an ephemeral master key that should be injected into Dokploy.
-*
-* @param filteredSecrets - The filtered secrets for the app
-* @returns Encrypted payload with master key
+* Format missing variables error message
 */
-function encryptSecretsForApp(filteredSecrets) {
-	const payload = encryptSecrets(filteredSecrets.secrets);
+function formatMissingVarsError(appName, missing, stage) {
+	return `Deployment failed: ${appName} is missing required environment variables:\n${missing.map((v) => `  - ${v}`).join("\n")}\n\nAdd them with:\n  gkm secrets:set <VAR_NAME> <value> --stage ${stage}\n\nOr add them to the app's requiredEnv in gkm.config.ts to have them auto-resolved.`;
+}
+/**
+* Validate that all required environment variables can be resolved
+*/
+function validateEnvVars(requiredVars, context) {
+	const { resolved, missing } = resolveEnvVars(requiredVars, context);
 	return {
-		appName: filteredSecrets.appName,
-		payload,
-		masterKey: payload.masterKey,
-		secretCount: Object.keys(filteredSecrets.secrets).length,
-		missingSecrets: filteredSecrets.missing
+		valid: missing.length === 0,
+		missing,
+		resolved
 	};
 }
-/**
-* Filter and encrypt secrets for an app in one step.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
-* @returns Encrypted secrets with master key
-*/
-function prepareSecretsForApp(stageSecrets, sniffedEnv) {
-	return encryptSecretsForApp(filterSecretsForApp(stageSecrets, sniffedEnv));
+//#endregion
+//#region src/target/dokploy/health.ts
+/** How long one request may take: a check that hangs is a failed check. */
+const REQUEST_TIMEOUT_MS = 1e4;
+/** An app never answered healthy enough times in a row. */
+var HealthCheckTimedOut = class extends Error {
+	app;
+	url;
+	timeoutMs;
+	lastStatus;
+	constructor(app, url, timeoutMs, lastStatus) {
+		super(`${app} did not become healthy within ${Math.round(timeoutMs / 1e3)}s: ${url} last ${lastStatus === void 0 ? "did not answer" : `answered ${lastStatus}`}. Check the app's logs in Dokploy. If it is only slow to start, raise deploy.dokploy.verify.healthTimeoutMs; if it serves its health route elsewhere, set deploy.dokploy.verify.healthCheckPath.`);
+		this.app = app;
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "HealthCheckTimedOut";
+	}
+};
+/** Wait `ms`, or reject with the signal's reason once it aborts. */
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) return reject(signal.reason);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal.reason);
+		};
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** One request: its status, or undefined when it never answered. */
+async function probe(url, signal) {
+	try {
+		const response = await fetch(url, { signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) });
+		response.body?.cancel().catch(() => {});
+		return response.status;
+	} catch {
+		signal.throwIfAborted();
+		return;
+	}
 }
 /**
-* Prepare secrets for multiple apps.
-*
-* @param stageSecrets - All secrets for the stage
-* @param sniffedApps - Map of app name to sniffed environment
-* @returns Map of app name to encrypted secrets
-*/
-function prepareSecretsForAllApps(stageSecrets, sniffedApps) {
-	const results = /* @__PURE__ */ new Map();
-	for (const [appName, sniffedEnv] of sniffedApps) if (sniffedEnv.requiredEnvVars.length > 0) {
-		const encrypted = prepareSecretsForApp(stageSecrets, sniffedEnv);
-		results.set(appName, encrypted);
+* Check `url` until it answers 2xx `healthyAfter` times in a row, emitting
+* `health.checked` for every check.
+*
+* @throws {HealthCheckTimedOut} when that has not happened within `timeoutMs`.
+*/
+async function verifyHealth(check) {
+	const { app, url, healthyAfter, intervalMs, timeoutMs, signal, emit } = check;
+	const deadline = Date.now() + timeoutMs;
+	let consecutive = 0;
+	let attempt = 0;
+	while (true) {
+		attempt++;
+		const status = await probe(url, signal);
+		const healthy = status !== void 0 && status >= 200 && status < 300;
+		emit({
+			type: "health.checked",
+			app,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		consecutive = healthy ? consecutive + 1 : 0;
+		if (consecutive >= healthyAfter) return;
+		if (Date.now() + intervalMs > deadline) throw new HealthCheckTimedOut(app, url, timeoutMs, status);
+		await sleep(intervalMs, signal);
 	}
-	return results;
 }
+/** The migrations of a deployed stage failed; the release stopped before any app. */
+var DeployMigrationsFailed = class extends Error {
+	stage;
+	reason;
+	constructor(stage, reason, message) {
+		super(`Migrating "${stage}" failed, so no app was released: ${message}. Migrations applied before the failing one stay applied; fix it and deploy again.`);
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "DeployMigrationsFailed";
+	}
+};
 /**
-* Generate a report on secrets preparation.
-*/
-function generateSecretsReport(encryptedApps, sniffedApps) {
-	const appsWithSecrets = [];
-	const appsWithoutSecrets = [];
-	const appsWithMissingSecrets = [];
-	for (const [appName, sniffedEnv] of sniffedApps) {
-		if (sniffedEnv.requiredEnvVars.length === 0) {
-			appsWithoutSecrets.push(appName);
-			continue;
-		}
-		const encrypted = encryptedApps.get(appName);
-		if (encrypted) {
-			appsWithSecrets.push(appName);
-			if (encrypted.missingSecrets.length > 0) appsWithMissingSecrets.push({
-				appName,
-				missing: encrypted.missingSecrets
+* The URLs a stage's migrations connect with, keyed as the migrator reads
+* them, grouped by the database their cluster serves — for the targets that
+* have a migration to apply. Empty when none does, so a deploy publishes
+* nothing for a project that has not written one.
+*/
+async function migrationUrls(root, manifest, env) {
+	const byDatabase = /* @__PURE__ */ new Map();
+	for (const target of migrationTargets(manifest)) {
+		if ((await migrationFiles(join(root, target.migrations))).size === 0) continue;
+		for (const role of ["ownerUrl", "url"]) {
+			const key = provideKey(target.id, role);
+			const url = env[key];
+			if (!url) continue;
+			const database = new URL(url).pathname.slice(1);
+			byDatabase.set(database, {
+				...byDatabase.get(database),
+				[key]: url
 			});
 		}
 	}
-	return {
-		totalApps: sniffedApps.size,
-		appsWithSecrets: appsWithSecrets.sort(),
-		appsWithoutSecrets: appsWithoutSecrets.sort(),
-		appsWithMissingSecrets
-	};
+	return byDatabase;
+}
+const answer = discriminatedUnion("reason", [object({
+	reason: literal("migrated"),
+	runs: array(object({
+		migrations: string(),
+		applied: array(string())
+	}))
+}), object({
+	reason: literal("failed"),
+	error: looseObject({
+		name: string(),
+		message: string()
+	})
+})]);
+/** Apply every pending migration, in the sandbox, as each construct's owner. */
+async function runMigrations(options) {
+	const sandbox = options.sandbox ?? activeSandbox() ?? new LocalSandbox({ root: options.root });
+	const { value } = await runWorker(sandbox, "migrations", {
+		name: "migrate-worker",
+		args: [JSON.stringify({
+			root: options.root,
+			manifest: options.manifest,
+			patterns: options.patterns
+		})],
+		cwd: options.root,
+		timeoutMs: options.timeoutMs ?? 9e5,
+		secrets: options.urls,
+		signal: options.signal,
+		schema: answer
+	});
+	if (value.reason === "failed") throw new DeployMigrationsFailed(options.stage, value.error.name, value.error.message);
+	return value.runs;
 }
 //#endregion
-//#region src/deploy/index.ts
+//#region src/target/dokploy/postgres.ts
 /**
-* Deploy Module
-*
-* Handles deployment of GKM workspaces to various providers (Docker, Dokploy).
+* Reaching a Dokploy Postgres from where the deploy runs.
 *
-* ## Per-App Database Credentials
-*
-* When deploying to Dokploy with Postgres, this module creates per-app database
-* users with isolated schemas. This follows the same pattern as local dev mode
-* (docker/postgres/init.sh).
-*
-* ### How It Works
-*
-* 1. **Provisioning**: Creates Postgres service with master credentials
-* 2. **User Creation**: For each backend app that needs DATABASE_URL:
-*    - Generates a unique password (stored in deploy state)
-*    - Creates a database user with that password
-*    - Assigns schema permissions based on app name
-* 3. **Schema Assignment**:
-*    - `api` app: Uses `public` schema (shared tables)
-*    - Other apps (e.g., `auth`): Get their own schema with `search_path` set
-* 4. **Environment Injection**: Each app receives its own DATABASE_URL
-*
-* ### Security
-*
-* - External Postgres port is enabled only during user creation, then disabled
-* - Each app can only access its own schema
-* - Credentials are stored in `.gkm/deploy-{stage}.json` (gitignored)
-* - Subsequent deploys reuse existing credentials from state
-*
-* ### Example Flow
-*
-* ```
-* gkm deploy --stage production
-*   ├─ Create Postgres (user: postgres, db: myproject)
-*   ├─ Enable external port temporarily
-*   ├─ Create user "api" → public schema
-*   ├─ Create user "auth" → auth schema (search_path=auth)
-*   ├─ Disable external port
-*   ├─ Deploy "api" with DATABASE_URL=postgresql://api:xxx@postgres:5432/myproject
-*   └─ Deploy "auth" with DATABASE_URL=postgresql://auth:yyy@postgres:5432/myproject
-* ```
-*
-* @module deploy
+* A Dokploy Postgres answers on the server's Docker network and nowhere else:
+* its address is its service name, which only another container there
+* resolves. Two steps of a deploy need it from outside — the role DDL the
+* provisioners defer, and the migrations `release` applies — so the cluster
+* is published on an external port for exactly as long as they take, and
+* closed again whatever happens.
 */
-const logger = output;
+const logger$1 = output;
+/** A Postgres published for the role DDL never accepted a connection. */
+var PostgresNotReady = class extends Error {
+	host;
+	port;
+	attempts;
+	constructor(host, port, attempts) {
+		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
+		this.host = host;
+		this.port = port;
+		this.attempts = attempts;
+		this.name = "PostgresNotReady";
+	}
+};
+/** No port could be published for a cluster, so its DDL cannot reach it. */
+var PostgresPortUnavailable = class extends Error {
+	appName;
+	taken;
+	constructor(appName, taken) {
+		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
+		this.appName = appName;
+		this.taken = taken;
+		this.name = "PostgresPortUnavailable";
+	}
+};
 /**
 * Wait for Postgres to be ready to accept connections.
 *
@@ -1772,14 +1724,7 @@ const logger = output;
 * Used after enabling the external port to ensure the database is accessible
 * before creating users.
 *
-* @param host - The Postgres server hostname
-* @param port - The external port (typically 5432)
-* @param user - Master database user (postgres)
-* @param password - Master database password
-* @param database - Database name to connect to
-* @param maxRetries - Maximum number of connection attempts (default: 30)
-* @param retryIntervalMs - Milliseconds between retries (default: 2000)
-* @throws Error if Postgres is not ready after maxRetries
+* @throws {PostgresNotReady} if Postgres is not ready after maxRetries
 */
 async function waitForPostgres(host, port, user, password, database, maxRetries = 30, retryIntervalMs = 2e3) {
 	for (let i = 0; i < maxRetries; i++) try {
@@ -1797,49 +1742,12 @@ async function waitForPostgres(host, port, user, password, database, maxRetries
 		return;
 	} catch {
 		if (i < maxRetries - 1) {
-			logger.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
+			logger$1.log(`   Waiting for Postgres... (${i + 1}/${maxRetries})`);
 			await new Promise((r) => setTimeout(r, retryIntervalMs));
 		}
 	}
 	throw new PostgresNotReady(host, port, maxRetries);
 }
-/** A Postgres published for the role DDL never accepted a connection. */
-var PostgresNotReady = class extends Error {
-	host;
-	port;
-	attempts;
-	constructor(host, port, attempts) {
-		super(`Postgres not ready after ${attempts} retries (${host}:${port}). Check that the port is reachable from here — a firewall in front of the server drops it silently — and deploy again.`);
-		this.host = host;
-		this.port = port;
-		this.attempts = attempts;
-		this.name = "PostgresNotReady";
-	}
-};
-/** No port could be published for a cluster, so its DDL cannot reach it. */
-var PostgresPortUnavailable = class extends Error {
-	appName;
-	taken;
-	constructor(appName, taken) {
-		super(`Could not publish a port for ${appName}. In use on this server: ${[...taken].sort((a, b) => a - b).join(", ") || "none reported"}. The role DDL needs to reach the cluster from here.`);
-		this.appName = appName;
-		this.taken = taken;
-		this.name = "PostgresPortUnavailable";
-	}
-};
-/**
-* Run the manifest's DDL against a Dokploy Postgres.
-*
-* The cluster is only reachable from outside while an external port is
-* published, so this opens one, applies, and leaves it as it found it. The
-* alternative — running DDL from inside the network — needs a container to run
-* it in, which is what `DatabaseBootstrap` is on AWS and what a Dokploy target
-* has no equivalent for yet.
-*
-* The applier is the local target's, so every statement asks whether it is
-* needed first: a redeploy is free, and a half-applied run recovers by being
-* run again.
-*/
 /**
 * A high port for one service, the same one every time.
 *
@@ -1852,32 +1760,80 @@ function derivedPort(appName) {
 	const digest = createHash("sha256").update(appName).digest();
 	return 49152 + (digest[0] << 8 | digest[1]) % 16e3;
 }
-async function applyDeclaredStatements(api, postgres, serverHostname, statements) {
-	let externalPort = await api.getPostgres(postgres.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
+/** The hostname of the Dokploy server, from its API endpoint. */
+function serverHostname(endpoint) {
+	return new URL(endpoint).hostname;
+}
+/**
+* Publish `cluster` on an external port of the server at `host`, and wait
+* until it accepts a connection there.
+*/
+async function publishPostgres(api, cluster, host) {
+	let externalPort = await api.getPostgres(cluster.postgresId).then((current) => current.externalPort).catch(() => null) ?? void 0;
 	const opened = externalPort === void 0;
 	if (externalPort === void 0) {
 		const taken = await api.publishedPorts().catch(() => /* @__PURE__ */ new Set());
-		const candidates = [5432, derivedPort(postgres.appName)].filter((port) => !taken.has(port));
+		const candidates = [5432, derivedPort(cluster.appName)].filter((port) => !taken.has(port));
 		for (const candidate of candidates) try {
-			await api.savePostgresExternalPort(postgres.postgresId, candidate);
+			await api.savePostgresExternalPort(cluster.postgresId, candidate);
 			externalPort = candidate;
 			break;
 		} catch (error) {
 			if (!(error instanceof Error ? error.message : String(error)).includes("already in use")) throw error;
-			logger.log(`   Port ${candidate} is taken; trying another...`);
+			logger$1.log(`   Port ${candidate} is taken; trying another...`);
 		}
-		if (externalPort === void 0) throw new PostgresPortUnavailable(postgres.appName, [...taken]);
-		logger.log(`   Publishing ${postgres.appName} on ${externalPort}...`);
+		if (externalPort === void 0) throw new PostgresPortUnavailable(cluster.appName, [...taken]);
+		logger$1.log(`   Publishing ${cluster.appName} on ${externalPort}...`);
+	}
+	const port = externalPort;
+	let closed = false;
+	const close = async () => {
+		if (!opened || closed) return;
+		closed = true;
+		await api.savePostgresExternalPort(cluster.postgresId, null).then(() => api.deployPostgres(cluster.postgresId)).catch(() => {
+			logger$1.log(`   ⚠ Could not close external port ${port} on ${cluster.appName} — close it in Dokploy.`);
+		});
+	};
+	try {
+		await api.deployPostgres(cluster.postgresId);
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName);
+	} catch (error) {
+		await close();
+		throw error;
 	}
-	await api.deployPostgres(postgres.postgresId);
-	await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName);
+	return {
+		cluster,
+		host,
+		port,
+		close
+	};
+}
+/**
+* A URL the cluster's containers use — its service name, its internal port —
+* pointed at where `published` answers from here instead.
+*/
+function publishedUrl(url, published) {
+	const parsed = new URL(url);
+	parsed.hostname = published.host;
+	parsed.port = String(published.port);
+	return parsed.toString();
+}
+/**
+* Run the manifest's DDL against a published Dokploy Postgres.
+*
+* The applier is the local target's, so every statement asks whether it is
+* needed first: a redeploy is free, and a half-applied run recovers by being
+* run again.
+*/
+async function applyDeclaredStatements(published, statements) {
+	const { cluster, host, port } = published;
 	const client = { async query(database, sql, values) {
 		const connection = new Client({
-			host: serverHostname,
-			port: externalPort,
-			user: postgres.databaseUser,
-			password: postgres.databasePassword,
-			database: database ?? postgres.databaseName,
+			host,
+			port,
+			user: cluster.databaseUser,
+			password: cluster.databasePassword,
+			database: database ?? cluster.databaseName,
 			connectionTimeoutMillis: 15e3
 		});
 		connection.on("error", () => {});
@@ -1888,35 +1844,22 @@ async function applyDeclaredStatements(api, postgres, serverHostname, statements
 			await connection.end();
 		}
 	} };
-	const unpublish = async () => {
-		if (!opened) return;
-		await api.savePostgresExternalPort(postgres.postgresId, null).then(() => api.deployPostgres(postgres.postgresId)).catch(() => {
-			logger.log(`   ⚠ Could not close external port ${externalPort} on ${postgres.appName} — close it in Dokploy.`);
-		});
-	};
 	let lastError;
-	try {
-		for (let attempt = 1; attempt <= 3; attempt++) try {
-			return await applyDeclared(client, statements);
-		} catch (error) {
-			lastError = error;
-			if (attempt === 3) break;
-			const message = error instanceof Error ? error.message : String(error);
-			logger.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
-			await new Promise((resolve) => setTimeout(resolve, 1e4));
-			await waitForPostgres(serverHostname, externalPort, postgres.databaseUser, postgres.databasePassword, postgres.databaseName).catch(() => {});
-		}
-		throw lastError;
-	} finally {
-		await unpublish();
+	for (let attempt = 1; attempt <= 3; attempt++) try {
+		return await applyDeclared(client, statements);
+	} catch (error) {
+		lastError = error;
+		if (attempt === 3) break;
+		const message = error instanceof Error ? error.message : String(error);
+		logger$1.log(`   ⏳ Cluster still settling (${message}); retrying (${attempt}/2)...`);
+		await new Promise((resolve) => setTimeout(resolve, 1e4));
+		await waitForPostgres(host, port, cluster.databaseUser, cluster.databasePassword, cluster.databaseName).catch(() => {});
 	}
+	throw lastError;
 }
-/**
-* Get the server hostname from the Dokploy endpoint URL
-*/
-function getServerHostname(endpoint) {
-	return new URL(endpoint).hostname;
-}
+//#endregion
+//#region src/target/dokploy/engine.ts
+const logger = output;
 /**
 * The variables an app cannot start without.
 *
@@ -1944,6 +1887,19 @@ var BackendDeployFailed = class extends Error {
 		this.name = "BackendDeployFailed";
 	}
 };
+/**
+* Sites failed to release or to answer. Every site is attempted before this
+* is thrown, so one broken site does not keep the others back — but the run
+* fails, and what failed is rolled back.
+*/
+var FrontendDeployFailed = class extends Error {
+	apps;
+	constructor(apps, cause) {
+		super(`Frontend deployment failed for ${apps.join(", ")}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.apps = apps;
+		this.name = "FrontendDeployFailed";
+	}
+};
 /** An app's environment needs values the stage does not have. */
 var MissingEnvVars = class extends Error {
 	app;
@@ -1972,6 +1928,16 @@ const CHILD_STDIO = {
 	],
 	ignore: "ignore"
 };
+/** The defaults of `deploy.dokploy.verify`. */
+function verifySettings(config) {
+	return {
+		deploymentTimeoutMs: config?.deploymentTimeoutMs ?? 6e5,
+		healthCheckPath: config?.healthCheckPath ?? "/health",
+		healthyAfter: config?.healthyAfter ?? 3,
+		intervalMs: config?.intervalMs ?? 2e3,
+		healthTimeoutMs: config?.healthTimeoutMs ?? 3e5
+	};
+}
 /**
 * Deploy every app in a workspace to Dokploy: the engine under the built-in
 * `dokploy` target.
@@ -2022,7 +1988,14 @@ async function validateDokploy(phase) {
 	};
 	return {
 		...run,
-		preflight: await preflight(run)
+		preflight: await preflight(run),
+		verify: verifySettings(workspace.deploy.dokploy?.verify),
+		atomic: phase.atomic,
+		releasing: {
+			switched: /* @__PURE__ */ new Map(),
+			failed: /* @__PURE__ */ new Set()
+		},
+		published: /* @__PURE__ */ new Map()
 	};
 }
 /**
@@ -2060,6 +2033,19 @@ async function preflight({ workspace, manifest, stage, secrets: secretsStore, ct
 * before it is created, so a run stopped part way is finished by the next.
 */
 async function provisionDokploy(run) {
+	try {
+		await provision(run);
+	} catch (error) {
+		await closePublished(run);
+		throw error;
+	}
+}
+/** Unpublish every cluster the run still has published. */
+async function closePublished(run) {
+	for (const published of run.published.values()) await published.close();
+	run.published.clear();
+}
+async function provision(run) {
 	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
 	const { stageSecrets } = run.preflight;
 	const changes = [];
@@ -2163,6 +2149,7 @@ async function provisionDokploy(run) {
 	if (skippedMobileApps.length > 0) logger.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	let declaredEnv = {};
 	let declaredClusters = {};
+	let migrations = /* @__PURE__ */ new Map();
 	{
 		logger.log("\n📦 Provisioning declared constructs...");
 		const appUrls = {};
@@ -2185,20 +2172,25 @@ async function provisionDokploy(run) {
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
 		if (Object.keys(declaredEnv).length > 0) logger.log(`   🔌 Resolved ${Object.keys(declaredEnv).length} declared URL(s)`);
-		if (declared.statements.length > 0) {
-			const serverHostname = getServerHostname(endpoint);
-			for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
-				const statements = declared.statements.filter((statement) => statement.database === databaseName);
-				if (statements.length === 0) continue;
-				const created = await applyDeclaredStatements(api, cluster, serverHostname, statements);
-				logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
+		migrations = await migrationUrls(workspace.root, manifest, declaredEnv);
+		const host = serverHostname(endpoint);
+		for (const [databaseName, cluster] of Object.entries(declared.clusters)) {
+			const statements = declared.statements.filter((statement) => statement.database === databaseName);
+			if (statements.length === 0) continue;
+			const published = await publishPostgres(api, cluster, host);
+			run.published.set(databaseName, published);
+			const created = await applyDeclaredStatements(published, statements);
+			if (!migrations.has(databaseName)) {
+				await published.close();
+				run.published.delete(databaseName);
 			}
+			logger.log(`   🗄️  ${databaseName}: applied ${statements.length} statement(s), ${created} new`);
 		}
 	}
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
 		logger.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-DIVCbfee.mjs");
+		const { provisionBackupDestination } = await import("./backup-provisioner-C8DnCmxK.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -2236,14 +2228,22 @@ async function provisionDokploy(run) {
 		registry,
 		registryId,
 		declaredEnv,
+		declaredClusters,
+		migrations,
 		changes,
 		applied
 	};
 }
 /**
-* Each app's image built and pushed, its application configured and
-* deployed, and its domain attached: backends first, each failure stopping
-* the run; then sites, whose build args are the backends' public URLs.
+* The stage's migrations, then each app's image built and pushed, its
+* application configured and deployed, and its domain attached — counted as
+* released only once Dokploy's deployment has finished.
+*
+* Backends first, each failure stopping the run; then they are checked, and
+* a backend that does not answer stops the run too — a site built against an
+* API that is down is a site that is down. Then the sites, whose build args
+* are the backends' public URLs: every one is attempted, and any that failed
+* fails the run. `verify` checks the sites.
 *
 * Building is here rather than in a `build` phase of its own because an
 * image is built beside its application — a site's build args are resolved
@@ -2254,12 +2254,25 @@ async function releaseDokploy(run) {
 	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
 	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
 	const project = { projectId: run.provisioned.projectId };
+	try {
+		await migrate(run);
+	} finally {
+		await closePublished(run);
+	}
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const publicUrls = {};
 	const results = [];
 	const appHostnames = /* @__PURE__ */ new Map();
 	const appDomainIds = /* @__PURE__ */ new Map();
+	const released = {
+		results,
+		publicUrls,
+		appHostnames,
+		appDomainIds,
+		applicationIds: /* @__PURE__ */ new Map()
+	};
+	run.released = released;
 	/** An app is up: say so, and remember where. */
 	const deployed = (appName, result, host) => {
 		const url = `https://${host}`;
@@ -2276,29 +2289,8 @@ async function releaseDokploy(run) {
 			url
 		});
 	};
-	/** An app failed: say so, and record it in the result. */
-	const failed = (appName, app, error) => {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
-		results.push({
-			appName,
-			type: app.type,
-			success: false,
-			error: message
-		});
-		ctx.emit({
-			type: "app.failed",
-			app: appName,
-			error: eventError(error)
-		});
-	};
 	/** An image is pushed: worth keeping even if what follows fails. */
-	const built = async (appName, image, ref) => {
-		setDeployedImage(state, appName, {
-			ref: image.imageRef ?? ref,
-			...image.digest ? { digest: image.digest } : {}
-		});
-		await journal.save();
+	const built = (appName, image, ref) => {
 		ctx.emit({
 			type: "artifact.built",
 			app: appName,
@@ -2312,6 +2304,41 @@ async function releaseDokploy(run) {
 			id: image.digest ?? image.imageRef ?? ref
 		});
 	};
+	/**
+	* Point an app's application at its image and environment, deploy it,
+	* attach its domain, and wait for Dokploy to finish — then record the
+	* release, with what ran before it as the one a rollback restores.
+	*/
+	const release = async (appName, applicationId, image, envVars, host) => {
+		const app = workspace.apps[appName];
+		released.applicationIds.set(appName, applicationId);
+		const since = await api.latestDeploymentAt(applicationId);
+		const before = state.releases?.[appName]?.current;
+		run.releasing.switched.set(appName, {
+			applicationId,
+			...before ? { before } : {}
+		});
+		await api.saveDockerProvider(applicationId, image.ref, { registryId });
+		await api.saveApplicationEnv(applicationId, envVars.join("\n"));
+		logger.log(`      Deploying to Dokploy...`);
+		await api.deployApplication(applicationId);
+		const domainId = await ensureDomain(api, journal, host, app.port, applicationId, applied);
+		appHostnames.set(appName, host);
+		if (domainId) appDomainIds.set(appName, domainId);
+		logger.log(`      Waiting for the deployment to finish...`);
+		await api.waitForDeployment(applicationId, {
+			since,
+			timeoutMs: run.verify.deploymentTimeoutMs,
+			intervalMs: run.verify.intervalMs,
+			signal: ctx.signal
+		});
+		recordRelease(state, appName, {
+			...image,
+			tag: imageTag
+		});
+		await journal.save();
+		publicUrls[appName] = `https://${host}`;
+	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
 	if (backendApps.length > 0) {
@@ -2342,7 +2369,7 @@ async function releaseDokploy(run) {
 					credentials,
 					...dockerRun(workspace, app, ctx)
 				});
-				await built(appName, image, imageRef$1);
+				built(appName, image, imageRef$1);
 				const backendHost = hostOf(workspace, appName, stage);
 				const dependencyUrls = {};
 				if (app.dependencies) {
@@ -2373,14 +2400,10 @@ async function releaseDokploy(run) {
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
 				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
-				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
-				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger.log(`      Deploying to Dokploy...`);
-				await api.deployApplication(application.applicationId);
-				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId, applied);
-				appHostnames.set(appName, backendHost);
-				if (domainId) appDomainIds.set(appName, domainId);
-				publicUrls[appName] = `https://${backendHost}`;
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$1,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, backendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
@@ -2391,11 +2414,20 @@ async function releaseDokploy(run) {
 				logger.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				if (ctx.signal?.aborted) throw ctx.signal.reason;
-				failed(appName, app, error);
+				failed(run, appName, error);
 				throw new BackendDeployFailed(appName, error);
 			}
 		}
+		await settleDns(run, backendApps);
+		for (const appName of backendApps) try {
+			await checkHealth(run, appName);
+		} catch (error) {
+			if (ctx.signal?.aborted) throw ctx.signal.reason;
+			failed(run, appName, error);
+			throw new BackendDeployFailed(appName, error);
+		}
 	}
+	let frontendFailure;
 	if (frontendApps.length > 0) {
 		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
 		for (const appName of frontendApps) {
@@ -2447,21 +2479,17 @@ async function releaseDokploy(run) {
 					publicUrlArgs: publicUrlArgNames,
 					...dockerRun(workspace, app, ctx)
 				});
-				await built(appName, image, imageRef$2);
+				built(appName, image, imageRef$2);
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
 					`STAGE=${stage}`
 				];
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
-				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
-				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
-				logger.log(`      Deploying to Dokploy...`);
-				await api.deployApplication(application.applicationId);
-				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId, applied);
-				appHostnames.set(appName, frontendHost);
-				if (domainId) appDomainIds.set(appName, domainId);
-				publicUrls[appName] = `https://${frontendHost}`;
+				await release(appName, application.applicationId, {
+					ref: image.imageRef ?? imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, envVars, frontendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
@@ -2472,42 +2500,199 @@ async function releaseDokploy(run) {
 				logger.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
 				if (ctx.signal?.aborted) throw ctx.signal.reason;
-				failed(appName, app, error);
+				failed(run, appName, error);
+				frontendFailure ??= error;
 			}
 		}
 	}
 	logger.log("\n📋 Saving deploy state...");
 	await journal.save();
 	logger.log("   ✓ State saved");
-	run.released = {
-		results,
-		publicUrls,
-		appHostnames
-	};
+	if (frontendFailure !== void 0) throw new FrontendDeployFailed(frontendApps.filter((app) => run.releasing.failed.has(app)), frontendFailure);
 }
-/** DNS records for each released app, and Dokploy's validation of each domain. */
+/** Each released site answering, after its DNS. Backends were checked in `release`. */
 async function verifyDokploy(run) {
+	const { workspace, ctx } = run;
+	const sites = run.released.results.filter((result) => result.success).map((result) => result.appName).filter((app) => workspace.apps[app]?.type === "web");
+	if (sites.length === 0) return;
+	await settleDns(run, sites);
+	let failure;
+	for (const appName of sites) try {
+		await checkHealth(run, appName);
+	} catch (error) {
+		if (ctx.signal.aborted) throw ctx.signal.reason;
+		failed(run, appName, error);
+		failure ??= error;
+	}
+	if (failure !== void 0) throw new FrontendDeployFailed(sites.filter((app) => run.releasing.failed.has(app)), failure);
+}
+/**
+* An app failed to release or to answer: say so, mark it for rollback, and
+* record it in the result — over the success it was recorded as, if its
+* health is what failed.
+*/
+function failed(run, appName, error) {
+	const app = run.workspace.apps[appName];
+	const message = error instanceof Error ? error.message : "Unknown error";
+	logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
+	const results = run.released.results;
+	const recorded = results.find((result) => result.appName === appName);
+	if (recorded) {
+		recorded.success = false;
+		recorded.error = message;
+	} else results.push({
+		appName,
+		type: app.type,
+		success: false,
+		error: message
+	});
+	run.releasing.failed.add(appName);
+	run.ctx.emit({
+		type: "app.failed",
+		app: appName,
+		error: eventError(error)
+	});
+}
+/**
+* The stage's pending migrations, applied in the deploy's sandbox against
+* each cluster published for them. Nothing is published, and nothing runs,
+* for a project with no migration to apply.
+*/
+async function migrate(run) {
+	const { workspace, manifest, stage, ctx } = run;
+	const { api, endpoint, migrations, declaredClusters } = run.provisioned;
+	if (migrations.size === 0) return;
+	logger.log("\n🗄️  Applying migrations...");
+	const host = serverHostname(endpoint);
+	const urls = {};
+	for (const [database, keys] of migrations) {
+		const cluster = declaredClusters[database];
+		if (!cluster) continue;
+		let published = run.published.get(database);
+		if (!published) {
+			published = await publishPostgres(api, cluster, host);
+			run.published.set(database, published);
+		}
+		for (const [key, url] of Object.entries(keys)) urls[key] = publishedUrl(url, published);
+	}
+	const runs = await runMigrations({
+		root: workspace.root,
+		stage,
+		manifest,
+		patterns: constructGlobs(workspace),
+		urls,
+		signal: ctx.signal
+	});
+	for (const { migrations: folder, applied } of runs) logger.log(applied.length === 0 ? `   ✓ ${folder}: up to date` : `   ✓ ${folder}: applied ${applied.join(", ")}`);
+}
+/**
+* DNS records for `apps`' hosts, their propagation, and Dokploy's validation
+* of each domain — before anything is asked of them by name.
+*/
+async function settleDns(run, apps) {
 	const { workspace } = run;
 	const { api, endpoint, journal, state } = run.provisioned;
-	const { appHostnames } = run.released;
+	const appHostnames = new Map([...run.released.appHostnames].filter(([app]) => apps.includes(app)));
 	const dnsConfig = workspace.deploy.dns;
-	if (dnsConfig && appHostnames.size > 0) {
-		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
-		if (dnsResult?.serverIp && appHostnames.size > 0) {
-			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
-			await journal.save();
+	if (!dnsConfig || appHostnames.size === 0) return;
+	const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
+	if (dnsResult?.serverIp) {
+		await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
+		await journal.save();
+	}
+	if (dnsResult?.success) {
+		logger.log("\n🔒 Validating domains for SSL certificates...");
+		for (const [appName, hostname] of appHostnames) try {
+			const result = await api.validateDomain(hostname);
+			if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
+			else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
+		} catch (validationError) {
+			const message = validationError instanceof Error ? validationError.message : "Unknown error";
+			logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
 		}
-		if (dnsResult?.success && appHostnames.size > 0) {
-			logger.log("\n🔒 Validating domains for SSL certificates...");
-			for (const [appName, hostname] of appHostnames) try {
-				const result = await api.validateDomain(hostname);
-				if (result.isValid) logger.log(`   ✓ ${appName}: ${hostname} → ${result.resolvedIp}`);
-				else logger.log(`   ⚠ ${appName}: ${hostname} not valid`);
-			} catch (validationError) {
-				const message = validationError instanceof Error ? validationError.message : "Unknown error";
-				logger.log(`   ⚠ ${appName}: validation failed - ${message}`);
-			}
+	}
+}
+/**
+* Whether a released app answers: `healthyAfter` 2xx in a row from its
+* health route under its domain. An app without a domain has nothing to ask
+* by name, so Dokploy's finished deployment is its check.
+*/
+async function checkHealth(run, appName) {
+	const { workspace, verify, ctx } = run;
+	const { appHostnames, appDomainIds, applicationIds } = run.released;
+	const host = appHostnames.get(appName);
+	if (!host || !appDomainIds.has(appName)) {
+		ctx.emit({
+			type: "health.checked",
+			app: appName,
+			url: `dokploy:application.status/${applicationIds.get(appName)}`,
+			healthy: true,
+			attempt: 1
+		});
+		logger.log(`   ✓ ${appName}: no domain, so its finished deployment is its check`);
+		return;
+	}
+	const url = `https://${host}${workspace.apps[appName].type === "web" ? "/" : verify.healthCheckPath}`;
+	logger.log(`\n🩺 Checking ${appName} at ${url}...`);
+	await verifyHealth({
+		app: appName,
+		url,
+		healthyAfter: verify.healthyAfter,
+		intervalMs: verify.intervalMs,
+		timeoutMs: verify.healthTimeoutMs,
+		signal: ctx.signal,
+		emit: ctx.emit
+	});
+	logger.log(`   ✓ ${appName} healthy (${verify.healthyAfter} in a row)`);
+}
+/**
+* Point an application back at `image`, deploy it, and wait for Dokploy to
+* finish. The environment stays the newer release's: it is resolved from the
+* stage, which a rollback does not change, and holds no image of its own.
+*/
+async function restoreImage(api, options) {
+	const { applicationId, image, registryId, verify, signal } = options;
+	const since = await api.latestDeploymentAt(applicationId);
+	await api.saveDockerProvider(applicationId, image.ref, registryId ? { registryId } : void 0);
+	await api.deployApplication(applicationId);
+	await api.waitForDeployment(applicationId, {
+		since,
+		timeoutMs: verify.deploymentTimeoutMs,
+		intervalMs: verify.intervalMs,
+		signal
+	});
+}
+/**
+* Put back what ran before this run, after its `release` or `verify` failed:
+* the apps that failed — or, `atomic`, every app the run released — each
+* pointed at its previous image and redeployed. An app released for the
+* first time has nothing to go back to and is left as it is.
+*/
+async function rollbackDokploy(run, failure) {
+	const { switched, failed: failedApps } = run.releasing;
+	const apps = [...switched.keys()].filter((app) => run.atomic || failedApps.has(app));
+	if (!run.provisioned || apps.length === 0) {
+		logger.log(`\n⏪ Nothing to roll back: the ${failure.phase} failed before any app was switched.`);
+		return;
+	}
+	const { api, journal, state, registryId } = run.provisioned;
+	logger.log(`\n⏪ Rolling back ${run.atomic ? "every app this run released" : "what failed"}: ${apps.join(", ")}`);
+	for (const appName of apps) {
+		const { applicationId, before } = switched.get(appName);
+		if (!before) {
+			logger.log(`   ⚠ ${appName}: this was its first release, so there is nothing to restore`);
+			continue;
 		}
+		await restoreImage(api, {
+			applicationId,
+			image: before,
+			registryId,
+			verify: run.verify,
+			signal: run.ctx.signal
+		});
+		recordRollback(state, appName, before);
+		await journal.save();
+		logger.log(`   ✓ ${appName} rolled back to ${before.ref}`);
 	}
 }
 /** What the run did, printed as the summary it always ended with. */
@@ -2624,10 +2809,14 @@ async function ensureDomain(api, journal, host, port, applicationId, applied) {
 function isAbort(error) {
 	return error instanceof Error && error.name === "AbortError";
 }
-/** Where docker runs for one app: in the app's own directory. */
+/**
+* Where docker runs for one app: the workspace root, building from the
+* Dockerfile `gkm docker` writes for the app there.
+*/
 function dockerRun(workspace, app, ctx) {
 	return {
-		cwd: resolve(workspace.root, app.path),
+		cwd: workspace.root,
+		appPath: app.path,
 		...ctx.signal ? { signal: ctx.signal } : {},
 		...ctx.stdio ? { stdio: ctx.stdio } : {}
 	};
@@ -2794,6 +2983,6 @@ async function planDokploy(run) {
 /** Why a mobile app is left out of a Dokploy deploy. */
 const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
-export { provisionDokploy as a, verifyDokploy as c, RegistryNotFound as d, ProjectNotOwned as f, planDokploy as i, RegistryAmbiguous as l, MissingEnvVars as n, releaseDokploy as o, dokployResult as r, validateDokploy as s, BackendDeployFailed as t, RegistryNotConfigured as u };
+export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=deploy-CZ5nlpsu.mjs.map
+//# sourceMappingURL=engine-Gs0abjuj.mjs.map