diff --git a/src/cli.js b/src/cli.js
index c120ec3..c053713 100755
--- a/src/cli.js
+++ b/src/cli.js
@@ -4,7 +4,7 @@ import { Command } from "commander";
 import { providersList, providersAdd, providersRemove, providersDefaultCmd } from "./commands/providers.js";
 import { doctor } from "./commands/doctor.js";
 import { deploy } from "./commands/deploy.js";
-import { appsList, appsInfo, appsDestroy } from "./commands/apps.js";
+import { appsList, appsInfo, appsCreate, appsDestroy } from "./commands/apps.js";
 import {
   configShow,
   configSet,
@@ -64,29 +64,34 @@ providersCmd
 
 program
   .command("deploy [name] [path]")
-  .description("Deploy an app from a Dockerfile (name auto-generated if omitted)")
-  .option("--compute <name>", "Provider for compute")
-  .option("--registry <name>", "Provider for container registry")
-  .option("-t, --tag <tag>", "Image tag (default: deploy-<timestamp>)")
-  .option("-e, --env <vars...>", "Set env vars (KEY=VALUE)")
-  .option(
-    "--regions <hints>",
-    "Comma-separated location hints (wnam,enam,sam,weur,eeur,apac,oc,afr,me)"
-  )
-  .option("-i, --instances <n>", "Instances per region", parseInt)
-  .option("--port <port>", "Container port", parseInt)
-  .option("--sleep <duration>", "Sleep after idle (e.g. 5m, 30s, never)", "30s")
-  .option("--instance-type <type>", "Instance type (lite, base, standard, large)")
-  .option("--vcpu <n>", "vCPU allocation (e.g. 0.0625, 0.5, 1, 2)", parseFloat)
-  .option("--memory <mb>", "Memory in MiB (e.g. 256, 512, 1024)", parseInt)
-  .option("--disk <mb>", "Disk in MB (e.g. 2000, 5000)", parseInt)
-  .option("--dns <name>", "Provider for DNS records")
-  .option("--no-observability", "Disable Workers observability/logs")
-  .option("--db <name>", "Database provider (for --backup-db)")
-  .option("--pre-deploy <cmd>", "Run command in container before push (e.g. migrations)")
-  .option("--backup-db", "Backup database before deploying")
+  .description("Build and deploy an app (portal: app must exist — create with apps create)")
+  .option("-t, --tag <tag>", "Image tag (default: timestamp)")
+  .option("--dockerfile <path>", "Path to Dockerfile (relative to build context)")
+  .option("--build-secret <secrets...>", "Docker BuildKit secrets passed to docker build (e.g. id=github_token,env=MY_TOKEN)")
   .option("--json", "Output result as JSON")
   .option("-y, --yes", "Skip confirmation prompt")
+  // BYOC-only options (ignored in portal mode):
+  .option("--compute <name>", "BYOC: compute provider")
+  .option("--registry <name>", "BYOC: container registry provider")
+  .option("-e, --env <vars...>", "BYOC: set env vars (KEY=VALUE)")
+  .option("--regions <hints>", "BYOC: location hints (wnam,enam,sam,weur,eeur,apac,oc,afr,me)")
+  .option("-i, --instances <n>", "BYOC: instances per region", parseInt)
+  .option("--port <port>", "BYOC: container port", parseInt)
+  .option("--sleep <duration>", "BYOC: sleep after idle (e.g. 5m, 30s, never)")
+  .option("--instance-type <type>", "BYOC: instance type (lite, basic, standard, standard-2..4, dev)")
+  .option("--vcpu <n>", "BYOC: vCPU allocation", parseFloat)
+  .option("--memory <mb>", "BYOC: memory in MiB", parseInt)
+  .option("--disk <mb>", "BYOC: disk in MB", parseInt)
+  .option("--dns <name>", "BYOC: DNS provider")
+  .option("--no-observability", "BYOC: disable Workers observability/logs")
+  .option("--db <name>", "BYOC: database provider (for --backup-db)")
+  .option("--pre-deploy <cmd>", "BYOC: run command in container before push")
+  .option("--backup-db", "BYOC: backup database before deploying")
+  .option("--gateway", "BYOC: deploy behind gateway")
+  .option("--hostname <domain>", "BYOC: gateway hostname")
+  .option("--groups <groups>", "BYOC: gateway access groups (comma-separated)")
+  .option("--match-mode <mode>", "BYOC: gateway group match mode (any|all)", "any")
+  .option("--path-prefix <prefix>", "BYOC: gateway path prefix", "/")
   .action(deploy);
 
 // --- Apps (topic root = list) ---
@@ -100,6 +105,32 @@ apps
   .option("--json", "Output as JSON")
   .action(appsList);
 
+apps
+  .command("create <name>")
+  .description("Register a new app with its configuration (portal mode)")
+  .option("--compute <label>", "Cloud provider label (required)")
+  .option("--registry <label>", "Container registry label")
+  .option("--regions <hints>", "Location hints, comma-separated (e.g. euw,wnam)")
+  .option("-i, --instances <n>", "Instances per region (default: 2)", parseInt)
+  .option("--port <port>", "Container port (default: 8080)", parseInt)
+  .option("--sleep <duration>", "Idle sleep timeout (e.g. 5m, 30s, never; default: 30s)")
+  .option("--instance-type <type>", "Instance type (lite, basic, standard, standard-2..4, dev)")
+  .option("--vcpu <n>", "vCPU allocation (e.g. 0.0625, 0.5, 1, 2)", parseFloat)
+  .option("--memory <mb>", "Memory in MiB (e.g. 256, 512, 1024)", parseInt)
+  .option("--disk <mb>", "Disk in MB (e.g. 2000, 5000)", parseInt)
+  .option("-e, --env <vars...>", "Initial env vars (KEY=VALUE)")
+  .option("--no-observability", "Disable Workers observability/logs")
+  .option("--gateway", "Place app behind gateway (protected by shared secret)")
+  .option("--hostname <domain>", "Gateway: public hostname (e.g. app.example.com)")
+  .option("--groups <groups>", "Gateway: required access groups (comma-separated)")
+  .option("--match-mode <mode>", "Gateway: group match mode (any|all)", "any")
+  .option("--path-prefix <prefix>", "Gateway: path prefix (default: /)", "/")
+  .option("--sm-connection <label>", "Secret manager: connection label (e.g. infisical)")
+  .option("--sm-project-id <id>", "Secret manager: project / workspace ID")
+  .option("--sm-environment <env>", "Secret manager: environment (default: production)")
+  .option("--sm-path <path>", "Secret manager: secret path (default: /)")
+  .action(appsCreate);
+
 apps
   .command("info [name]")
   .description("Show detailed app information")
@@ -166,10 +197,11 @@ program
     "Comma-separated location hints (wnam,enam,sam,weur,eeur,apac,oc,afr,me)"
   )
   .option("-i, --instances <n>", "Instances per region", parseInt)
-  .option("--instance-type <type>", "Instance type (lite, base, standard, large)")
+  .option("--instance-type <type>", "Instance type (lite, basic, standard, standard-2..4, dev)")
   .option("--vcpu <n>", "vCPU allocation (e.g. 0.0625, 0.5, 1, 2)", parseFloat)
   .option("--memory <mb>", "Memory in MiB (e.g. 256, 512, 1024)", parseInt)
   .option("--disk <mb>", "Disk in MB (e.g. 2000, 5000)", parseInt)
+  .option("--sleep <duration>", "Sleep after idle (e.g. 10m, 30s, 1h)")
   .option("--json", "Output as JSON")
   .action(scale);
 
@@ -379,7 +411,7 @@ program
 
 // --- Portals ---
 
-import { portalsAdd, portalsList, portalsRemove } from "./commands/portals.js";
+import { portalsAdd, portalsList, portalsRemove, portalsDefaults } from "./commands/portals.js";
 
 var portalsCmd = program.command("portals").description("Manage portal connections");
 
@@ -398,6 +430,20 @@ portalsCmd
   .description("Disconnect from portal")
   .action(portalsRemove);
 
+var portalsDefaultsCmd = portalsCmd
+  .command("defaults")
+  .description("Show or set portal-level defaults");
+
+portalsDefaultsCmd
+  .command("show", { isDefault: true })
+  .description("Show current portal defaults")
+  .action(() => portalsDefaults([]));
+
+portalsDefaultsCmd
+  .command("set <args...>")
+  .description("Set portal defaults (KEY=VALUE ...)")
+  .action((args) => portalsDefaults(["set", ...args]));
+
 // --- Doctor ---
 
 program
@@ -405,6 +451,68 @@ program
   .description("Check system setup and provider connectivity")
   .action(doctor);
 
+// --- Secrets ---
+
+import {
+  secretsList,
+  secretsPush,
+  secretsDelete,
+  secretsConfigure,
+  secretsSync,
+} from "./commands/secrets.js";
+
+var secretsCmd = program
+  .command("secrets")
+  .description("Manage per-app secrets in configured secret manager");
+
+secretsCmd
+  .command("list [app]", { isDefault: true })
+  .description("List secret keys for an app (values hidden)")
+  .action(secretsList);
+
+secretsCmd
+  .command("push [args...]")
+  .description("Push secrets to app (KEY=VALUE ...)")
+  .action((args) => secretsPush(args, {}));
+
+secretsCmd
+  .command("sync [app]")
+  .description("Fetch secrets from SM and sync to CF Worker bindings")
+  .action(secretsSync);
+
+secretsCmd
+  .command("delete <args...>")
+  .description("Delete a secret from app ([app] KEY)")
+  .action((args) => secretsDelete(args, {}));
+
+secretsCmd
+  .command("configure [app]")
+  .description("Configure secret manager for an app (interactive)")
+  .action(secretsConfigure);
+
+// --- SSH Keys ---
+
+import { sshKeysList, sshKeysAdd, sshKeysRemove } from "./commands/ssh-keys.js";
+
+var sshKeysCmd = program
+  .command("ssh-keys")
+  .description("Manage SSH authorized keys for container access");
+
+sshKeysCmd
+  .command("list [app]", { isDefault: true })
+  .description("List SSH keys configured for an app")
+  .action(sshKeysList);
+
+sshKeysCmd
+  .command("add [args...]")
+  .description("Add SSH key ([app] <name> <public-key>)")
+  .action((args) => sshKeysAdd(args, {}));
+
+sshKeysCmd
+  .command("remove [args...]")
+  .description("Remove SSH key by name ([app] <key-name>)")
+  .action((args) => sshKeysRemove(args, {}));
+
 // --- Top-level aliases ---
 
 program
diff --git a/src/commands/apps.js b/src/commands/apps.js
index 945859d..bf6744a 100644
--- a/src/commands/apps.js
+++ b/src/commands/apps.js
@@ -1,9 +1,91 @@
 import { success, fatal, hint, fmt, table } from "../lib/output.js";
 import { resolveAppName, readLink, unlinkApp } from "../lib/link.js";
 import { resolveStack } from "../lib/providers/resolve.js";
+import { getPortal, portalApi, getPortalAppByName } from "../lib/portal.js";
 import { createInterface } from "readline";
 
+function formatInstanceDesc(appConfig) {
+  if (appConfig.vcpu) {
+    return `${appConfig.vcpu} vCPU, ${appConfig.memory || "?"} MiB`;
+  }
+  return appConfig.instanceType || "lite";
+}
+
+function printAppInfo(name, appConfig, { url, gatewayHostname, provider, updatedAt, consoleUrl } = {}) {
+  console.log("");
+  console.log(`${fmt.bold("App:")}        ${fmt.app(name)}`);
+  if (url) console.log(`${fmt.bold("URL:")}        ${fmt.url(url)}`);
+  if (provider) console.log(`${fmt.bold("Provider:")}   ${provider}`);
+  if (gatewayHostname) console.log(`${fmt.bold("Gateway:")}    ${gatewayHostname}`);
+  console.log(
+    `${fmt.bold("Image:")}      ${appConfig.image || fmt.dim("(not deployed)")}`
+  );
+  if (appConfig.regions?.length) {
+    console.log(`${fmt.bold("Regions:")}    ${appConfig.regions.join(", ")}`);
+  }
+  if (appConfig.instances) {
+    console.log(`${fmt.bold("Instances:")}  ${appConfig.instances} per region`);
+  }
+  console.log(`${fmt.bold("Type:")}       ${formatInstanceDesc(appConfig)}`);
+  if (appConfig.disk) console.log(`${fmt.bold("Disk:")}       ${appConfig.disk} MB`);
+  if (appConfig.port) console.log(`${fmt.bold("Port:")}       ${appConfig.port}`);
+  if (appConfig.sleepAfter) console.log(`${fmt.bold("Sleep:")}      ${appConfig.sleepAfter}`);
+  console.log(
+    `${fmt.bold("Domains:")}    ${(appConfig.domains || []).join(", ") || fmt.dim("(none)")}`
+  );
+  var envCount = (appConfig.envKeys || []).length;
+  var secretCount = (appConfig.secretKeys || []).length;
+  var totalCount = envCount + secretCount;
+  if (!appConfig.envKeys && appConfig.env) totalCount = Object.keys(appConfig.env).length;
+  var envDisplay = secretCount > 0 ? `${totalCount} (${secretCount} secret)` : `${totalCount}`;
+  console.log(`${fmt.bold("Env vars:")}   ${envDisplay}`);
+  if (appConfig.dbId) {
+    console.log(`${fmt.bold("Database:")}   ${appConfig.dbName || appConfig.dbId}`);
+  }
+  if (appConfig.deployedAt) {
+    console.log(`${fmt.bold("Deployed:")}   ${appConfig.deployedAt}`);
+  }
+  if (appConfig.createdAt) {
+    console.log(`${fmt.bold("Created:")}    ${appConfig.createdAt}`);
+  }
+  if (updatedAt) {
+    console.log(`${fmt.bold("Updated:")}    ${new Date(updatedAt).toISOString()}`);
+  }
+  if (consoleUrl) {
+    console.log(`${fmt.bold("Console:")}    ${fmt.url(consoleUrl)}`);
+  }
+  console.log("");
+}
 export async function appsList(options) {
+  // Portal mode: list apps from portal
+  if (!options.compute && getPortal()) {
+    var data = await portalApi("GET", "/apps");
+    var apps = data.apps ?? data;
+    if (apps.length === 0) {
+      if (options.json) {
+        console.log("[]");
+      } else {
+        process.stderr.write("No apps deployed.\n");
+        hint("Next", "relight deploy");
+      }
+      return;
+    }
+    if (options.json) {
+      console.log(JSON.stringify(apps, null, 2));
+      return;
+    }
+    var rows = apps.map((a) => [
+      fmt.app(a.name),
+      a.provider || "-",
+      a.url ? fmt.url(a.url) : fmt.dim("(no url)"),
+      a.gateway_enabled ? (a.gateway_hostname || fmt.dim("(gateway)")) : "-",
+      a.updated_at ? new Date(a.updated_at).toISOString().slice(0, 16) : "-",
+    ]);
+    console.log(table(["NAME", "PROVIDER", "URL", "HOSTNAME", "LAST UPDATED"], rows));
+    return;
+  }
+
+  // BYOC mode: list apps from compute provider
   var stack = await resolveStack(options);
   var { cfg, provider: appProvider } = stack.app;
 
@@ -34,6 +116,25 @@ export async function appsList(options) {
 
 export async function appsInfo(name, options) {
   name = resolveAppName(name);
+
+  // Portal mode: fetch full app detail (config + live CF worker config)
+  if (!options.compute && getPortal()) {
+    var app = await getPortalAppByName(name);
+    if (!app) fatal(`App ${fmt.app(name)} not found.`);
+    var appConfig = Object.assign({}, app.config || {}, app.liveInfo?.appConfig || {});
+    if (options.json) {
+      console.log(JSON.stringify({ app, appConfig }, null, 2));
+      return;
+    }
+    printAppInfo(name, appConfig, {
+      url: app.url || app.liveInfo?.url,
+      gatewayHostname: app.gateway_enabled ? (app.gateway_hostname || fmt.dim("(no hostname)")) : null,
+      provider: app.provider || fmt.dim("(unknown)"),
+      updatedAt: app.updated_at,
+    });
+    return;
+  }
+
   var stack = await resolveStack(options);
   var { cfg, provider: appProvider } = stack.app;
 
@@ -53,44 +154,131 @@ export async function appsInfo(name, options) {
     return;
   }
 
-  console.log("");
-  console.log(`${fmt.bold("App:")}        ${fmt.app(name)}`);
-  if (info.url) console.log(`${fmt.bold("URL:")}        ${fmt.url(info.url)}`);
-  console.log(
-    `${fmt.bold("Image:")}      ${appConfig.image || fmt.dim("(not deployed)")}`
-  );
-  console.log(`${fmt.bold("Regions:")}    ${appConfig.regions.join(", ")}`);
-  console.log(`${fmt.bold("Instances:")}  ${appConfig.instances} per region`);
-  console.log(`${fmt.bold("Port:")}       ${appConfig.port}`);
-  console.log(
-    `${fmt.bold("Domains:")}    ${(appConfig.domains || []).join(", ") || fmt.dim("(none)")}`
-  );
-  var envCount = (appConfig.envKeys || []).length;
-  var secretCount = (appConfig.secretKeys || []).length;
-  var totalCount = envCount + secretCount;
-  if (!appConfig.envKeys && appConfig.env) totalCount = Object.keys(appConfig.env).length;
-  var envDisplay = secretCount > 0 ? `${totalCount} (${secretCount} secret)` : `${totalCount}`;
-  console.log(
-    `${fmt.bold("Env vars:")}   ${envDisplay}`
-  );
-  if (appConfig.dbId) {
-    console.log(`${fmt.bold("Database:")}   ${appConfig.dbName || appConfig.dbId}`);
+  printAppInfo(name, appConfig, { url: info.url, consoleUrl: info.consoleUrl });
+}
+
+export async function appsCreate(name, options) {
+  if (!getPortal()) {
+    fatal(
+      "apps create requires a portal connection.",
+      `Connect first: ${fmt.cmd("relight portals add <url>")}`
+    );
   }
-  if (appConfig.deployedAt) {
-    console.log(`${fmt.bold("Deployed:")}   ${appConfig.deployedAt}`);
+
+  // Fetch portal defaults once — used as fallback for all options
+  var defaults = {};
+  try {
+    defaults = await portalApi("GET", "/settings/defaults") || {};
+  } catch {}
+
+  var compute = options.compute || defaults.compute || null;
+  if (!compute) {
+    fatal(
+      "--compute is required (or set a default in portal Settings).",
+      `Example: ${fmt.cmd(`relight apps create ${name} --compute cf-prod`)}`
+    );
   }
-  if (appConfig.createdAt) {
-    console.log(`${fmt.bold("Created:")}    ${appConfig.createdAt}`);
+
+  var registryLabel = options.registry || defaults.registry || null;
+
+  // Build app config — flags take priority, then portal defaults, then hardcoded fallbacks
+  var regions = options.regions
+    ? options.regions.split(",").map((r) => r.trim())
+    : (defaults.regions?.length ? defaults.regions : ["enam"]);
+
+  var env = {};
+  var envKeys = [];
+  if (options.env) {
+    for (var v of options.env) {
+      var eq = v.indexOf("=");
+      if (eq !== -1) {
+        env[v.substring(0, eq)] = v.substring(eq + 1);
+        envKeys.push(v.substring(0, eq));
+      }
+    }
+  }
+
+  var appConfig = {
+    name,
+    regions,
+    instances: options.instances || defaults.instances || 2,
+    port: options.port || 8080,
+    sleepAfter: options.sleep || defaults.sleep_after || "30s",
+    env,
+    envKeys,
+    secretKeys: [],
+    domains: [],
+    createdAt: new Date().toISOString(),
+  };
+
+  if (options.instanceType) {
+    appConfig.instanceType = options.instanceType;
+  } else if (options.vcpu) {
+    appConfig.vcpu = options.vcpu;
+    if (options.memory) appConfig.memory = options.memory;
+  } else if (defaults.instance_type) {
+    appConfig.instanceType = defaults.instance_type;
+  } else {
+    appConfig.instanceType = "lite";
+  }
+  if (options.disk) appConfig.disk = options.disk;
+  if (options.observability === false) appConfig.observability = false;
+
+  // Build gateway config (flag overrides default, default enables with no options)
+  var gateway = null;
+  var useGateway = options.gateway || defaults.gateway_enabled;
+  if (useGateway) {
+    gateway = {
+      hostname: options.hostname || null,
+      path_prefix: options.pathPrefix || "/",
+      groups: options.groups
+        ? options.groups.split(",").map((g) => g.trim()).filter(Boolean)
+        : [],
+      match_mode: options.matchMode || "any",
+    };
+  }
+
+  // Build secret manager config (flag overrides default connection label)
+  var secretManager = null;
+  var smConnection = options.smConnection || defaults.sm_connection_label || null;
+  if (smConnection || options.smProjectId) {
+    secretManager = {};
+    if (smConnection) secretManager.connection_label = smConnection;
+    if (options.smProjectId) secretManager.project_id = options.smProjectId;
+    if (options.smEnvironment) secretManager.environment = options.smEnvironment;
+    if (options.smPath) secretManager.path = options.smPath;
+  }
+
+  var data = await portalApi("POST", "/apps", {
+    name,
+    cloudLabel: compute,
+    registryLabel: registryLabel,
+    config: appConfig,
+    gateway,
+    secretManager,
+  }).catch((err) => fatal(err.message));
+
+  success(`App ${fmt.app(name)} created.`);
+  process.stderr.write(`  ${fmt.bold("Compute:")}  ${compute}\n`);
+  process.stderr.write(`  ${fmt.bold("Regions:")}  ${regions.join(", ")}\n`);
+  process.stderr.write(`  ${fmt.bold("Sleep:")}    ${appConfig.sleepAfter}\n`);
+  if (appConfig.instanceType) {
+    process.stderr.write(`  ${fmt.bold("Type:")}     ${appConfig.instanceType}\n`);
+  } else if (appConfig.vcpu) {
+    process.stderr.write(`  ${fmt.bold("vCPU:")}     ${appConfig.vcpu}${appConfig.memory ? `, ${appConfig.memory} MiB` : ""}\n`);
+  }
+  if (gateway) {
+    process.stderr.write(`  ${fmt.bold("Gateway:")}  enabled${gateway.hostname ? ` → ${gateway.hostname}` : ""}\n`);
   }
-  if (info.consoleUrl) {
-    console.log(`${fmt.bold("Console:")}    ${fmt.url(info.consoleUrl)}`);
+  if (secretManager) {
+    process.stderr.write(`  ${fmt.bold("SM:")}       ${secretManager.connection_label || "configured"}${secretManager.project_id ? ` / ${secretManager.project_id}` : ""}\n`);
   }
+  process.stderr.write("\n");
+  hint("Deploy", `relight deploy ${name}`);
 }
 
 export async function appsDestroy(name, options) {
   name = resolveAppName(name);
-  var stack = await resolveStack(options);
-  var { cfg, provider: appProvider } = stack.app;
 
   if (options.confirm !== name) {
     if (process.stdin.isTTY) {
@@ -112,6 +300,27 @@ export async function appsDestroy(name, options) {
 
   process.stderr.write(`Destroying ${fmt.app(name)}...\n`);
 
+  // Portal mode
+  if (!options.compute && getPortal()) {
+    try {
+      var data = await portalApi("GET", "/apps");
+      var apps = data.apps ?? data;
+      var app = apps.find((a) => a.name === name);
+      if (!app) fatal(`App ${fmt.app(name)} not found.`);
+      await portalApi("DELETE", `/apps/${app.id}`);
+    } catch (e) {
+      fatal(`Could not destroy ${fmt.app(name)}.`, e.message);
+    }
+    var linked = readLink();
+    if (linked && linked.app === name) unlinkApp();
+    success(`App ${fmt.app(name)} destroyed.`);
+    return;
+  }
+
+  // BYOC mode
+  var stack = await resolveStack(options);
+  var { cfg, provider: appProvider } = stack.app;
+
   try {
     await appProvider.destroyApp(cfg, name);
   } catch (e) {
diff --git a/src/commands/clouds.js b/src/commands/clouds.js
deleted file mode 100644
index 5f002bf..0000000
--- a/src/commands/clouds.js
+++ /dev/null
@@ -1,495 +0,0 @@
-import { createInterface } from "readline";
-import { execSync } from "child_process";
-import { existsSync } from "fs";
-import { resolve } from "path";
-import { success, fatal, hint, fmt, table } from "../lib/output.js";
-import {
-  tryGetConfig,
-  saveConfig,
-  getAuthenticatedClouds,
-  CLOUD_NAMES,
-  CLOUD_IDS,
-} from "../lib/config.js";
-import { TOKEN_URL, verifyToken, listAccounts } from "../lib/clouds/cf.js";
-import {
-  readKeyFile,
-  mintAccessToken,
-  verifyProject,
-} from "../lib/clouds/gcp.js";
-import { verifyCredentials as awsVerify } from "../lib/clouds/aws.js";
-import {
-  verifyCredentials as azureVerify,
-  parseResourceGroupInput,
-} from "../lib/clouds/azure.js";
-import kleur from "kleur";
-
-function prompt(rl, question) {
-  return new Promise((resolve) => rl.question(question, resolve));
-}
-
-export async function cloudsList() {
-  var clouds = getAuthenticatedClouds();
-
-  if (clouds.length === 0) {
-    process.stderr.write("No clouds configured.\n");
-    process.stderr.write(
-      `\n${fmt.dim("Hint:")} ${fmt.cmd("relight clouds add")} to add one.\n`
-    );
-    return;
-  }
-
-  var headers = ["ID", "CLOUD"];
-  var rows = clouds.map((id) => [fmt.bold(id), CLOUD_NAMES[id] || id]);
-
-  console.log(table(headers, rows));
-}
-
-export async function cloudsAdd(name) {
-  var rl = createInterface({ input: process.stdin, output: process.stderr });
-
-  if (!name) {
-    process.stderr.write(`\n${kleur.bold("Add a cloud provider")}\n\n`);
-    for (var i = 0; i < CLOUD_IDS.length; i++) {
-      process.stderr.write(
-        `  ${kleur.bold(`[${i + 1}]`)} ${CLOUD_NAMES[CLOUD_IDS[i]]}\n`
-      );
-    }
-    process.stderr.write("\n");
-
-    var choice = await prompt(rl, `Select cloud [1-${CLOUD_IDS.length}]: `);
-    var idx = parseInt(choice, 10) - 1;
-
-    if (isNaN(idx) || idx < 0 || idx >= CLOUD_IDS.length) {
-      rl.close();
-      fatal("Invalid selection.");
-    }
-
-    name = CLOUD_IDS[idx];
-  }
-
-  name = normalizeCloud(name);
-  if (!CLOUD_NAMES[name]) {
-    rl.close();
-    fatal(
-      `Unknown cloud: ${name}`,
-      `Supported: ${CLOUD_IDS.join(", ")}`
-    );
-  }
-
-  process.stderr.write(
-    `\n${kleur.bold(`Authenticate with ${CLOUD_NAMES[name]}`)}\n`
-  );
-
-  var cloudConfig;
-
-  switch (name) {
-    case "cf":
-      cloudConfig = await authCloudflare(rl);
-      break;
-    case "gcp":
-      cloudConfig = await authGCP(rl);
-      break;
-    case "aws":
-      cloudConfig = await authAWS(rl);
-      break;
-    case "azure":
-      cloudConfig = await authAzure(rl);
-      break;
-  }
-
-  rl.close();
-
-  // Merge into existing config
-  var config = tryGetConfig() || { clouds: {} };
-  if (!config.clouds) config.clouds = {};
-  config.clouds[name] = cloudConfig;
-
-  if (!config.default_cloud) {
-    config.default_cloud = name;
-  }
-
-  saveConfig(config);
-
-  success(`Authenticated with ${CLOUD_NAMES[name]}!`);
-
-  if (config.default_cloud === name) {
-    hint("Default", `${CLOUD_NAMES[name]} is your default cloud`);
-  }
-  hint("Next", `relight deploy <name> .`);
-}
-
-export async function cloudsRemove(name) {
-  if (!name) {
-    fatal("Usage: relight clouds remove <name>");
-  }
-
-  name = normalizeCloud(name);
-
-  var config = tryGetConfig();
-  if (!config || !config.clouds || !config.clouds[name]) {
-    fatal(`Cloud '${name}' not found.`);
-  }
-
-  var rl = createInterface({ input: process.stdin, output: process.stderr });
-  var answer = await new Promise((resolve) =>
-    rl.question(`Remove cloud '${CLOUD_NAMES[name] || name}'? [y/N] `, resolve)
-  );
-  rl.close();
-
-  if (!answer.match(/^y(es)?$/i)) {
-    process.stderr.write("Cancelled.\n");
-    return;
-  }
-
-  delete config.clouds[name];
-  if (config.default_cloud === name) {
-    var remaining = Object.keys(config.clouds).filter(
-      (id) => config.clouds[id] && Object.keys(config.clouds[id]).length > 0
-    );
-    config.default_cloud = remaining[0] || null;
-  }
-  saveConfig(config);
-
-  success(`Cloud ${fmt.bold(CLOUD_NAMES[name] || name)} removed.`);
-}
-
-function normalizeCloud(input) {
-  var aliases = {
-    cloudflare: "cf",
-    cf: "cf",
-    gcp: "gcp",
-    "google-cloud": "gcp",
-    "cloud-run": "gcp",
-    aws: "aws",
-    amazon: "aws",
-    "app-runner": "aws",
-    azure: "azure",
-    microsoft: "azure",
-    "container-apps": "azure",
-  };
-  return aliases[input.toLowerCase()] || input.toLowerCase();
-}
-
-// --- Cloudflare ---
-
-async function authCloudflare(rl) {
-  process.stderr.write(`\n  ${kleur.bold("Setup")}\n\n`);
-  process.stderr.write(`  1. Log in to the Cloudflare dashboard\n`);
-  process.stderr.write(`  2. Open this link to create a pre-filled API token:\n\n`);
-  process.stderr.write(`     ${fmt.url(TOKEN_URL)}\n\n`);
-  process.stderr.write(`  3. Click ${kleur.bold("Continue to summary")} then ${kleur.bold("Create Token")}\n`);
-  process.stderr.write(`  4. Copy the token\n\n`);
-
-  var apiToken = await prompt(rl, "Paste your API token: ");
-  apiToken = (apiToken || "").trim();
-  if (!apiToken) fatal("No token provided.");
-
-  process.stderr.write("\nVerifying...\n");
-  try {
-    await verifyToken(apiToken);
-  } catch (e) {
-    fatal("Token verification failed.", e.message);
-  }
-
-  var accounts = await listAccounts(apiToken);
-  if (accounts.length === 0) {
-    fatal("No accounts found for this token.");
-  }
-
-  var account;
-  if (accounts.length === 1) {
-    account = accounts[0];
-  } else {
-    process.stderr.write("\nMultiple accounts found:\n\n");
-    for (var i = 0; i < accounts.length; i++) {
-      process.stderr.write(
-        `  ${kleur.bold(`[${i + 1}]`)} ${accounts[i].name} ${fmt.dim(`(${accounts[i].id})`)}\n`
-      );
-    }
-    process.stderr.write("\n");
-
-    var choice = await prompt(rl, `Select account [1-${accounts.length}]: `);
-    var idx = parseInt(choice, 10) - 1;
-    if (isNaN(idx) || idx < 0 || idx >= accounts.length) {
-      fatal("Invalid selection.");
-    }
-    account = accounts[idx];
-  }
-
-  process.stderr.write(
-    `  Account: ${fmt.bold(account.name)} ${fmt.dim(`(${account.id})`)}\n`
-  );
-
-  return { token: apiToken, accountId: account.id };
-}
-
-// --- GCP ---
-
-async function authGCP(rl) {
-  var SA_URL =
-    "https://console.cloud.google.com/iam-admin/serviceaccounts/create";
-  var ENABLE_APIS =
-    "https://console.cloud.google.com/apis/enableflow?apiid=run.googleapis.com,artifactregistry.googleapis.com,sqladmin.googleapis.com,dns.googleapis.com,logging.googleapis.com,monitoring.googleapis.com,firebase.googleapis.com,firebasehosting.googleapis.com";
-
-  process.stderr.write(`\n  ${kleur.bold("Setup")}\n\n`);
-  process.stderr.write(`  1. Enable the required APIs:\n`);
-  process.stderr.write(`     ${fmt.url(ENABLE_APIS)}\n\n`);
-  process.stderr.write(`  2. Create a service account:\n`);
-  process.stderr.write(`     ${fmt.url(SA_URL)}\n\n`);
-  process.stderr.write(`     Name it ${fmt.val("relight")} and grant these roles:\n`);
-  process.stderr.write(`       ${fmt.val("Cloud Run Admin")}\n`);
-  process.stderr.write(`       ${fmt.val("Artifact Registry Admin")}\n`);
-  process.stderr.write(`       ${fmt.val("Service Account User")}\n`);
-  process.stderr.write(`       ${fmt.val("Cloud SQL Admin")}\n`);
-  process.stderr.write(`       ${fmt.val("DNS Administrator")}\n`);
-  process.stderr.write(`       ${fmt.val("Firebase Admin")}\n`);
-  process.stderr.write(`       ${fmt.val("Firebase Hosting Admin")}\n`);
-  process.stderr.write(`       ${fmt.val("Logs Viewer")}\n`);
-  process.stderr.write(`       ${fmt.val("Monitoring Viewer")}\n\n`);
-  process.stderr.write(`  3. Go to the service account → ${kleur.bold("Keys")} tab\n`);
-  process.stderr.write(`  4. ${kleur.bold("Add Key")} → ${kleur.bold("Create new key")} → ${kleur.bold("JSON")}\n`);
-  process.stderr.write(`  5. Save the downloaded file\n\n`);
-
-  var keyPath = await prompt(rl, "Path to service account key JSON: ");
-  keyPath = (keyPath || "").trim();
-  if (!keyPath) fatal("No key file provided.");
-
-  keyPath = resolve(keyPath.replace(/^~\//, process.env.HOME + "/"));
-  if (!existsSync(keyPath)) {
-    fatal(`File not found: ${keyPath}`);
-  }
-
-  var key;
-  try {
-    key = readKeyFile(keyPath);
-  } catch (e) {
-    fatal("Failed to read key file.", e.message);
-  }
-
-  var project = key.project;
-  if (!project) {
-    project = await prompt(rl, "GCP project ID: ");
-    project = (project || "").trim();
-    if (!project) fatal("No project provided.");
-  }
-
-  process.stderr.write("\nVerifying...\n");
-
-  var token;
-  try {
-    token = await mintAccessToken(key.clientEmail, key.privateKey);
-  } catch (e) {
-    fatal("Failed to mint access token.", e.message);
-  }
-
-  try {
-    await verifyProject(token, project);
-  } catch (e) {
-    fatal("Project verification failed.", e.message);
-  }
-
-  process.stderr.write(`  Project: ${fmt.bold(project)}\n`);
-  process.stderr.write(`  Service account: ${fmt.dim(key.clientEmail)}\n`);
-
-  return { clientEmail: key.clientEmail, privateKey: key.privateKey, project };
-}
-
-// --- AWS ---
-
-async function authAWS(rl) {
-  var IAM_CONSOLE = "https://console.aws.amazon.com/iam/home#/users";
-
-  process.stderr.write(`\n  ${kleur.bold("Setup")}\n\n`);
-  process.stderr.write(`  1. Open the IAM console:\n`);
-  process.stderr.write(`     ${fmt.url(IAM_CONSOLE)}\n\n`);
-  process.stderr.write(`  2. Create a user and attach these policies:\n`);
-  process.stderr.write(`     ${fmt.val("AWSAppRunnerFullAccess")}\n`);
-  process.stderr.write(`     ${fmt.val("AmazonEC2ContainerRegistryFullAccess")}\n`);
-  process.stderr.write(`     ${fmt.val("AmazonRDSFullAccess")}\n`);
-  process.stderr.write(`     ${fmt.val("AmazonRoute53FullAccess")}\n`);
-  process.stderr.write(`     ${fmt.val("AmazonEC2ReadOnlyAccess")}\n`);
-  process.stderr.write(`     ${fmt.val("CloudWatchLogsReadOnlyAccess")}\n`);
-  process.stderr.write(`     ${fmt.val("IAMFullAccess")}\n\n`);
-  process.stderr.write(`  3. Go to the user's ${kleur.bold("Security credentials")} tab\n`);
-  process.stderr.write(`  4. Click ${kleur.bold("Create access key")} → choose ${kleur.bold("Command Line Interface")}\n`);
-  process.stderr.write(`  5. Copy the Access Key ID and Secret Access Key\n\n`);
-
-  // Detect from env vars as fallback
-  var detectedKeyId = process.env.AWS_ACCESS_KEY_ID || null;
-  var detectedSecret = process.env.AWS_SECRET_ACCESS_KEY || null;
-  var detectedRegion =
-    process.env.AWS_DEFAULT_REGION || process.env.AWS_REGION || null;
-
-  var accessKeyId;
-  if (detectedKeyId) {
-    var input = await prompt(
-      rl,
-      `AWS Access Key ID [${detectedKeyId.slice(0, 8)}...]: `
-    );
-    accessKeyId = (input || "").trim() || detectedKeyId;
-  } else {
-    accessKeyId = await prompt(rl, "AWS Access Key ID: ");
-    accessKeyId = (accessKeyId || "").trim();
-    if (!accessKeyId) fatal("No access key provided.");
-  }
-
-  var secretAccessKey;
-  if (detectedSecret && accessKeyId === detectedKeyId) {
-    var input = await prompt(rl, "AWS Secret Access Key [detected]: ");
-    secretAccessKey = (input || "").trim() || detectedSecret;
-  } else {
-    secretAccessKey = await prompt(rl, "AWS Secret Access Key: ");
-    secretAccessKey = (secretAccessKey || "").trim();
-    if (!secretAccessKey) fatal("No secret key provided.");
-  }
-
-  var defaultRegion = detectedRegion || "us-east-1";
-  var region = await prompt(rl, `AWS Region [${defaultRegion}]: `);
-  region = (region || "").trim() || defaultRegion;
-
-  process.stderr.write("\nVerifying...\n");
-  try {
-    await awsVerify({ accessKeyId, secretAccessKey }, region);
-  } catch (e) {
-    fatal("Credential verification failed.", e.message);
-  }
-
-  process.stderr.write(`  Region: ${fmt.bold(region)}\n`);
-
-  return { accessKeyId, secretAccessKey, region };
-}
-
-// --- Azure ---
-
-async function authAzure(rl) {
-  var PORTAL_URL = "https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade";
-
-  process.stderr.write(`\n  ${kleur.bold("Setup")}\n\n`);
-  process.stderr.write(`  1. Open the Azure portal:\n`);
-  process.stderr.write(`     ${fmt.url(PORTAL_URL)}\n\n`);
-  process.stderr.write(`  2. Register an app (or use an existing one)\n`);
-  process.stderr.write(`  3. Go to ${kleur.bold("Certificates & secrets")} → create a client secret\n`);
-  process.stderr.write(`  4. Note the ${kleur.bold("Application (client) ID")} and ${kleur.bold("Directory (tenant) ID")}\n`);
-  process.stderr.write(`  5. In your subscription, assign the app these roles:\n`);
-  process.stderr.write(`     ${fmt.val("Contributor")}\n`);
-  process.stderr.write(`     ${fmt.val("AcrPush")}\n\n`);
-
-  // Detect from env vars
-  var detectedTenant = process.env.AZURE_TENANT_ID || null;
-  var detectedClient = process.env.AZURE_CLIENT_ID || null;
-  var detectedSecret = process.env.AZURE_CLIENT_SECRET || null;
-  var detectedSubscription = process.env.AZURE_SUBSCRIPTION_ID || null;
-
-  var tenantId;
-  if (detectedTenant) {
-    var input = await prompt(rl, `Tenant ID [${detectedTenant.slice(0, 8)}...]: `);
-    tenantId = (input || "").trim() || detectedTenant;
-  } else {
-    tenantId = await prompt(rl, "Tenant ID: ");
-    tenantId = (tenantId || "").trim();
-    if (!tenantId) fatal("No tenant ID provided.");
-  }
-
-  var clientId;
-  if (detectedClient) {
-    var input = await prompt(rl, `Client ID [${detectedClient.slice(0, 8)}...]: `);
-    clientId = (input || "").trim() || detectedClient;
-  } else {
-    clientId = await prompt(rl, "Client ID: ");
-    clientId = (clientId || "").trim();
-    if (!clientId) fatal("No client ID provided.");
-  }
-
-  var clientSecret;
-  if (detectedSecret && clientId === detectedClient) {
-    var input = await prompt(rl, "Client secret [detected]: ");
-    clientSecret = (input || "").trim() || detectedSecret;
-  } else {
-    clientSecret = await prompt(rl, "Client secret: ");
-    clientSecret = (clientSecret || "").trim();
-    if (!clientSecret) fatal("No client secret provided.");
-  }
-
-  var subscriptionId;
-  if (detectedSubscription) {
-    var input = await prompt(rl, `Subscription ID [${detectedSubscription.slice(0, 8)}...]: `);
-    subscriptionId = (input || "").trim() || detectedSubscription;
-  } else {
-    subscriptionId = await prompt(rl, "Subscription ID: ");
-    subscriptionId = (subscriptionId || "").trim();
-    if (!subscriptionId) fatal("No subscription ID provided.");
-  }
-
-  var resourceGroupInput = await prompt(rl, "Resource group name or ID [relight]: ");
-  var resourceGroupRef;
-  try {
-    resourceGroupRef = parseResourceGroupInput(subscriptionId, resourceGroupInput);
-  } catch (e) {
-    fatal(e.message);
-  }
-  subscriptionId = resourceGroupRef.subscriptionId;
-
-  var useExistingResourceGroup = resourceGroupRef.isFullId;
-  if (!resourceGroupRef.isFullId) {
-    var existingOnly = await prompt(rl, "Use existing resource group only? [y/N]: ");
-    useExistingResourceGroup = !!existingOnly.match(/^y(es)?$/i);
-  }
-
-  var location = await prompt(rl, "Default location [eastus]: ");
-  location = (location || "").trim() || "eastus";
-
-  process.stderr.write("\nVerifying...\n");
-  try {
-    await azureVerify(tenantId, clientId, clientSecret, subscriptionId, {
-      resourceGroupId: resourceGroupRef.resourceGroupId,
-      existingOnly: useExistingResourceGroup,
-    });
-  } catch (e) {
-    fatal("Credential verification failed.", e.message);
-  }
-
-  if (!useExistingResourceGroup) {
-    try {
-      var { azureApi, mintAccessToken } = await import("../lib/clouds/azure.js");
-      var token = await mintAccessToken(tenantId, clientId, clientSecret);
-      await azureApi("PUT", resourceGroupRef.resourceGroupId, {
-        location,
-      }, token);
-    } catch (e) {
-      if (!e.message.includes("already exists") && !e.message.includes("200")) {
-        process.stderr.write(`  ${fmt.dim(`Note: Could not create resource group: ${e.message}`)}\n`);
-      }
-    }
-  }
-
-  process.stderr.write(`  Subscription: ${fmt.bold(subscriptionId)}\n`);
-  process.stderr.write(`  Resource group: ${fmt.bold(resourceGroupRef.resourceGroup)}\n`);
-  if (useExistingResourceGroup) {
-    process.stderr.write(`  ${fmt.dim("Using existing resource group (no create attempt)")}\n`);
-  }
-  process.stderr.write(`  Location: ${fmt.bold(location)}\n`);
-
-  return {
-    tenantId,
-    clientId,
-    clientSecret,
-    subscriptionId,
-    resourceGroup: resourceGroupRef.resourceGroup,
-    resourceGroupId: resourceGroupRef.isFullId ? resourceGroupRef.resourceGroupId : undefined,
-    location,
-  };
-}
-
-// --- Helpers ---
-
-function tryExec(cmd) {
-  try {
-    return execSync(cmd + " 2>/dev/null", {
-      stdio: ["pipe", "pipe", "pipe"],
-      encoding: "utf-8",
-      timeout: 5000,
-    }).trim() || null;
-  } catch {
-    return null;
-  }
-}
diff --git a/src/commands/db.js b/src/commands/db.js
index 43ab3e3..3edc7a6 100644
--- a/src/commands/db.js
+++ b/src/commands/db.js
@@ -2,6 +2,18 @@ import { phase, status, success, fatal, hint, fmt, table } from "../lib/output.j
 import { resolveAppName, readLink, linkApp } from "../lib/link.js";
 import { resolveStack } from "../lib/providers/resolve.js";
 import { createInterface } from "readline";
+
+async function portalDb(method, path, body) {
+  var { getPortal, portalApi } = await import("../lib/portal.js");
+  if (!getPortal()) return null;
+  return portalApi(method, path, body);
+}
+
+async function isPortalMode(options) {
+  if (options.db) return false;
+  var { getPortal } = await import("../lib/portal.js");
+  return !!getPortal();
+}
 import { readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync, statSync, existsSync, appendFileSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
@@ -54,6 +66,26 @@ function resolveDatabase(name, options) {
 export async function dbCreate(name, options) {
   if (!name) fatal("Database name is required.", `Usage: relight db create <name> --db <provider>`);
 
+  // Portal mode
+  if (await isPortalMode(options)) {
+    phase("Creating database");
+    status(`${name}...`);
+    var data;
+    try {
+      data = await portalDb("POST", "/dbs", { name, db_label: options.dbLabel || null });
+    } catch (e) {
+      fatal(e.message);
+    }
+    success(`Database ${fmt.app(name)} created!`);
+    console.log(`  ${fmt.bold("Provider:")}  ${data.label} (${data.provider})`);
+    if (data.dbName) console.log(`  ${fmt.bold("DB Name:")}   ${data.dbName}`);
+    if (data.connectionUrl) console.log(`  ${fmt.bold("DB URL:")}    ${fmt.url(data.connectionUrl)}`);
+    if (data.connectionUrl?.startsWith("postgres")) {
+      hint("Store connection URL as a secret", `relight secrets push DATABASE_URL="${data.connectionUrl}" --app <app-name>`);
+    }
+    return;
+  }
+
   var stack = await resolveStack(options, ["db"]);
   var { cfg, provider, name: providerName } = stack.db;
 
@@ -98,7 +130,19 @@ export async function dbCreate(name, options) {
     console.log(`  ${fmt.bold("DB URL:")}    ${fmt.url(result.connectionUrl)}`);
   }
   console.log(`  ${fmt.bold("Token:")}     ${result.dbToken}`);
-  hint("Next", `relight db attach ${name} <app>`);
+
+  if (provider.IS_POSTGRES && result.connectionUrl) {
+    // Import getPortal lazily — avoid errors when portal is not configured
+    var { getPortal } = await import("../lib/portal.js");
+    if (getPortal()) {
+      var masked = result.connectionUrl.replace(/:([^:@]+)@/, ":***@");
+      hint("Store connection URL as a secret", `relight secrets push ${name} DATABASE_URL="${masked}"`);
+    } else {
+      hint("Next", `relight db attach ${name} <app>`);
+    }
+  } else {
+    hint("Next", `relight db attach ${name} <app>`);
+  }
 }
 
 export async function dbDestroy(name, options) {
@@ -124,6 +168,18 @@ export async function dbDestroy(name, options) {
 
   phase("Destroying database");
 
+  // Portal mode
+  if (await isPortalMode(options)) {
+    var qs = options.dbLabel ? `?db=${options.dbLabel}` : "";
+    try {
+      await portalDb("DELETE", `/dbs/${name}${qs}`);
+    } catch (e) {
+      fatal(e.message);
+    }
+    success(`Database ${fmt.app(name)} destroyed.`);
+    return;
+  }
+
   var stack = await resolveStack(options, ["db"]);
   var { cfg, provider } = stack.db;
 
@@ -137,6 +193,22 @@ export async function dbDestroy(name, options) {
 }
 
 export async function dbList(options) {
+  // Portal mode
+  if (await isPortalMode(options)) {
+    var qs = options.dbLabel ? `?db=${options.dbLabel}` : "";
+    var data = await portalDb("GET", `/dbs${qs}`);
+    var databases = data.dbs || [];
+    if (options.json) { console.log(JSON.stringify(databases, null, 2)); return; }
+    if (databases.length === 0) {
+      console.log(fmt.dim("\n  No databases. Create one with: relight db create <name>\n"));
+      return;
+    }
+    var rows = databases.map((db) => [db.name, db.dbName || "-"]);
+    console.log(fmt.dim(`  Provider: ${data.label} (${data.provider})\n`));
+    console.log(table(["NAME", "DB NAME"], rows));
+    return;
+  }
+
   var stack = await resolveStack(options, ["db"]);
   var { cfg, provider } = stack.db;
 
@@ -310,6 +382,25 @@ export async function dbDetach(appName, options) {
 export async function dbInfo(name, options) {
   name = resolveDatabase(name, options);
 
+  // Portal mode
+  if (await isPortalMode(options)) {
+    var qs = options.dbLabel ? `?db=${options.dbLabel}` : "";
+    var info;
+    try {
+      info = await portalDb("GET", `/dbs/${name}${qs}`);
+    } catch (e) {
+      fatal(e.message);
+    }
+    if (options.json) { console.log(JSON.stringify(info, null, 2)); return; }
+    console.log("");
+    console.log(`${fmt.bold("Database:")}   ${fmt.app(name)}`);
+    console.log(`${fmt.bold("Provider:")}   ${info.label} (${info.provider})`);
+    if (info.dbName) console.log(`${fmt.bold("DB Name:")}    ${info.dbName}`);
+    if (info.connectionUrl) console.log(`${fmt.bold("DB URL:")}     ${fmt.url(info.connectionUrl)}`);
+    console.log("");
+    return;
+  }
+
   var stack = await resolveStack(options, ["db"]);
   var { cfg, provider, name: providerName } = stack.db;
 
diff --git a/src/commands/deploy.js b/src/commands/deploy.js
index 8d26b3c..0f681b0 100644
--- a/src/commands/deploy.js
+++ b/src/commands/deploy.js
@@ -6,10 +6,37 @@ import { join } from "path";
 import { phase, status, success, hint, fatal, fmt, generateAppName } from "../lib/output.js";
 import { readLink, linkApp, resolveAppName } from "../lib/link.js";
 import { resolveStack } from "../lib/providers/resolve.js";
-import { PROVIDERS, tryGetProviderConfig } from "../lib/config.js";
+import { PROVIDERS } from "../lib/config.js";
 import { dockerBuild, dockerTag, dockerPush, dockerLogin } from "../lib/docker.js";
 import { getPortal, portalApi } from "../lib/portal.js";
 
+function buildGatewayMeta(options, linked, prepGatewayConfig) {
+  // Priority: --gateway flag > .relight.yaml > portal prepare response
+  var isGateway = options.gateway || linked?.gateway;
+
+  if (!isGateway && prepGatewayConfig?.enabled) {
+    // Use portal's stored gateway config (no --gateway flag needed on redeploy)
+    return {
+      hostname: prepGatewayConfig.hostname,
+      path_prefix: prepGatewayConfig.path_prefix || "/",
+      groups: prepGatewayConfig.groups || [],
+      match_mode: prepGatewayConfig.match_mode || "any",
+    };
+  }
+
+  if (!isGateway) return null;
+  var hostname = options.hostname || linked?.gateway?.hostname || null;
+  var groups = options.groups
+    ? options.groups.split(",").map((g) => g.trim()).filter(Boolean)
+    : linked?.gateway?.groups || [];
+  return {
+    hostname,
+    path_prefix: options.pathPrefix || linked?.gateway?.path_prefix || "/",
+    groups,
+    match_mode: options.matchMode || linked?.gateway?.match_mode || "any",
+  };
+}
+
 function resolveDeployTarget(nameOrPath, path, mode) {
   var name;
   var dockerPath;
@@ -32,35 +59,6 @@ function resolveDeployTarget(nameOrPath, path, mode) {
   return { name, dockerPath };
 }
 
-function resolveProviderNames(options) {
-  var linked = readLink();
-  return {
-    compute: options.compute || linked?.compute || null,
-    dns: options.dns || linked?.dns || null,
-    registry: options.registry || linked?.registry || null,
-  };
-}
-
-function inferProviderType(name) {
-  if (!name) return null;
-  var configured = tryGetProviderConfig(name);
-  if (configured?.type) return configured.type;
-
-  var lower = name.toLowerCase();
-  if (lower.includes("azure")) return "azure";
-  if (lower.includes("ghcr")) return "ghcr";
-  if (lower.includes("cloudflare") || lower.startsWith("cf") || lower.includes("cf-")) return "cf";
-  if (lower.includes("aws")) return "aws";
-  if (lower.includes("gcp") || lower.includes("google")) return "gcp";
-  if (lower.includes("slicervm")) return "slicervm";
-  if (lower.includes("demo")) return "demo";
-  return null;
-}
-
-function providerSupportsRegistry(type) {
-  return ["cf", "gcp", "aws", "azure"].includes(type);
-}
-
 function buildEnvConfig(options) {
   var env = {};
   var envKeys = [];
@@ -77,71 +75,6 @@ function buildEnvConfig(options) {
   return { env, envKeys };
 }
 
-function buildPortalAppConfig(name, options, computeType, hasRegistry) {
-  var { env, envKeys } = buildEnvConfig(options);
-  var defaultRegion = !hasRegistry
-    ? "self-hosted"
-    : computeType === "gcp"
-      ? "us-central1"
-      : computeType === "aws"
-        ? "us-east-1"
-        : computeType === "azure"
-          ? "eastus"
-          : "enam";
-  var regions = options.regions
-    ? options.regions.split(",").map((r) => r.trim())
-    : [defaultRegion];
-  var now = new Date().toISOString();
-
-  var appConfig = {
-    name,
-    regions,
-    instances: options.instances || (hasRegistry ? 2 : 1),
-    port: options.port || 8080,
-    sleepAfter: options.sleep || "30s",
-    instanceType: options.instanceType
-      || ((!hasRegistry || computeType === "gcp" || computeType === "aws" || computeType === "azure")
-        ? undefined
-        : "lite"),
-    vcpu: options.vcpu || undefined,
-    memory: options.memory || undefined,
-    disk: options.disk || undefined,
-    env,
-    envKeys,
-    secretKeys: [],
-    domains: [],
-    createdAt: now,
-    deployedAt: now,
-  };
-
-  if (options.observability === false) appConfig.observability = false;
-  return appConfig;
-}
-
-async function ensurePortalApp(name, options) {
-  var names = resolveProviderNames(options);
-  if (!names.compute) {
-    fatal(
-      "Portal app does not exist yet and no compute provider was specified.",
-      `Run ${fmt.cmd("relight deploy my-app . --compute <portal-compute-label>")} to create it.`
-    );
-  }
-
-  var computeType = inferProviderType(names.compute);
-  var hasRegistry = !!names.registry || providerSupportsRegistry(computeType);
-  var appConfig = buildPortalAppConfig(name, options, computeType, hasRegistry);
-
-  status(`Creating app ${name} in portal...`);
-  await portalApi("POST", "/apps", {
-    name,
-    cloudLabel: names.compute,
-    registryLabel: names.registry || null,
-    config: appConfig,
-  });
-
-  return names;
-}
-
 export async function deploy(nameOrPath, path, options) {
   // --- Portal mode: delegate to portal for credentials & deploy ---
   var portal = getPortal();
@@ -343,7 +276,7 @@ export async function deploy(nameOrPath, path, options) {
   }
   phase("Building image");
   status(`${localTag} for ${platform}`);
-  dockerBuild(dockerPath, localTag, { platform });
+  dockerBuild(dockerPath, localTag, { platform, dockerfile: options.dockerfile, secrets: options.buildSecret });
 
   // --- Pre-deploy hook ---
   var linked = readLink();
@@ -358,16 +291,23 @@ export async function deploy(nameOrPath, path, options) {
     await runPreDeploy(preDeployCmd, localTag, appConfig, linked);
   }
 
-  if (!hasRegistry) {
-    // No registry: deploy extracts and uploads the image directly
-    phase("Deploying");
-    await appProvider.deploy(cfg, name, localTag, {
-      appConfig,
-      isFirstDeploy,
-      newSecrets,
-    });
-  } else {
-    // 2. Push to registry
+  var byocGateway = buildGatewayMeta(options, readLink());
+
+  // 2. Push image to registry
+  var deployImageTag;
+  if (providerType === "cf") {
+    // CF Containers only pulls from CF Registry / Docker Hub / ECR.
+    // Push directly to CF Registry regardless of --registry flag.
+    var { CF_REGISTRY, getRegistryCredentials } = await import("../lib/clouds/cf.js");
+    var cfTag = `${CF_REGISTRY}/${cfg.accountId}/relight-${name}:${Date.now()}`;
+    phase("Pushing to CF Registry");
+    var cfCreds = await getRegistryCredentials(cfg.accountId, cfg.apiToken);
+    dockerLogin(CF_REGISTRY, cfCreds.username, cfCreds.password);
+    dockerTag(localTag, cfTag);
+    status(`Pushing ${cfTag}...`);
+    dockerPush(cfTag);
+    deployImageTag = cfTag;
+  } else if (hasRegistry) {
     phase("Pushing to registry");
     status("Authenticating...");
     registryCreds = await registry.getCredentials(registryCfg);
@@ -376,26 +316,32 @@ export async function deploy(nameOrPath, path, options) {
     status(`Pushing ${remoteTag}...`);
     dockerTag(localTag, remoteTag);
     dockerPush(remoteTag);
-
-    // 3. Deploy via provider
-    phase("Deploying");
-    await appProvider.deploy(cfg, name, remoteTag, {
-      appConfig,
-      isFirstDeploy,
-      newSecrets,
-      registryName,
-      registryCredentials: registryCreds,
-    });
+    deployImageTag = remoteTag;
+  } else {
+    deployImageTag = localTag;
   }
 
+  // 3. Deploy
+  phase("Deploying");
+  appConfig.image = deployImageTag;
+  await appProvider.deploy(cfg, name, deployImageTag, {
+    appConfig,
+    isFirstDeploy,
+    newSecrets,
+    registryName,
+    registryCredentials: registryCreds,
+  });
+
   // 4. Resolve URL and report
   var url = await appProvider.getAppUrl(cfg, name);
+  var gatewayUrl = byocGateway ? `https://${byocGateway.hostname}${byocGateway.path_prefix}` : null;
 
   if (options.json) {
     var result = {
       name,
       image: hasRegistry ? remoteTag : localTag,
-      url,
+      url: gatewayUrl || url,
+      gateway: !!byocGateway,
       regions: appConfig.regions,
       instances: appConfig.instances,
       firstDeploy: isFirstDeploy,
@@ -406,10 +352,16 @@ export async function deploy(nameOrPath, path, options) {
     success(`App ${fmt.app(name)} deployed!`);
     process.stderr.write(`  ${fmt.bold("Name:")}  ${fmt.app(name)}\n`);
     process.stderr.write(`  ${fmt.bold("Image:")} ${hasRegistry ? remoteTag : localTag}\n`);
-    process.stderr.write(
-      `  ${fmt.bold("URL:")}   ${url ? fmt.url(url) : fmt.dim("(configure workers.dev subdomain to see URL)")}\n`
-    );
-    hint("Next", `relight open ${name}`);
+    if (byocGateway) {
+      process.stderr.write(`  ${fmt.bold("Access:")} ${fmt.dim("private (via gateway + secret)")}\n`);
+      process.stderr.write(`  ${fmt.bold("Gateway:")} ${gatewayUrl ? fmt.url(gatewayUrl) : fmt.dim("(configure gateway domain)")}\n`);
+      process.stderr.write(`  ${fmt.bold("Direct:")} ${url ? fmt.dim(url + " (blocked by secret)") : fmt.dim("n/a")}\n`);
+    } else {
+      process.stderr.write(
+        `  ${fmt.bold("URL:")}   ${url ? fmt.url(url) : fmt.dim("(configure workers.dev subdomain to see URL)")}\n`
+      );
+    }
+    hint("Next", byocDispatchNamespace ? `curl ${gatewayUrl}` : `relight open ${name}`);
   }
 
   // Link this directory to the app
@@ -424,27 +376,27 @@ export async function deploy(nameOrPath, path, options) {
 }
 
 // --- Portal mode deploy ---
-// CLI builds image, does `docker push` to portal (which acts as OCI registry proxy),
-// then triggers deployment. Docker handles layer caching natively.
+// CLI builds image, pushes to registry, then tells portal to deploy.
+// App must already exist — create it first with: relight apps create <name>
 async function deployViaPortal(nameOrPath, path, options) {
   var { name, dockerPath } = resolveDeployTarget(nameOrPath, path, "portal");
-  var providerNames = resolveProviderNames(options);
 
   var tag = options.tag || `${Date.now()}`;
   var localTag = `relight-${name}:${tag}`;
 
-  // 1. Get app config from portal (no credentials returned)
+  // 1. Fetch app config + credentials from portal
   phase("Preparing deploy via portal");
   var prep;
   try {
     prep = await portalApi("POST", `/deploy/${name}/prepare`);
   } catch (err) {
     if (err.message.includes(`App '${name}' not found`)) {
-      providerNames = await ensurePortalApp(name, options);
-      prep = await portalApi("POST", `/deploy/${name}/prepare`);
-    } else {
-      fatal(`Portal prepare failed: ${err.message}`);
+      fatal(
+        `App '${name}' not found in portal.`,
+        `Create it first: ${fmt.cmd(`relight apps create ${name} --compute <label>`)}`
+      );
     }
+    fatal(`Portal prepare failed: ${err.message}`);
   }
 
   var portal = getPortal();
@@ -452,14 +404,20 @@ async function deployViaPortal(nameOrPath, path, options) {
   var remoteTag = `${portalHost}/${name}:${tag}`;
 
   // 2. Show summary
-  process.stderr.write(`\n${fmt.bold("Deploy summary (portal mode)")}\n`);
+  process.stderr.write(`\n${fmt.bold("Deploy summary")}\n`);
   process.stderr.write(`${fmt.dim("-".repeat(40))}\n`);
-  process.stderr.write(`  ${fmt.bold("App:")}        ${fmt.app(name)}${prep.isFirstDeploy ? fmt.dim(" (new)") : ""}\n`);
-  process.stderr.write(`  ${fmt.bold("Provider:")}   ${fmt.cloud(prep.provider)}\n`);
-  process.stderr.write(`  ${fmt.bold("Path:")}       ${dockerPath}\n`);
-  process.stderr.write(`  ${fmt.bold("Image:")}      ${remoteTag}\n`);
+  process.stderr.write(`  ${fmt.bold("App:")}      ${fmt.app(name)}\n`);
+  process.stderr.write(`  ${fmt.bold("Provider:")} ${fmt.cloud(prep.provider)}\n`);
+  process.stderr.write(`  ${fmt.bold("Path:")}     ${dockerPath}\n`);
+  process.stderr.write(`  ${fmt.bold("Image:")}    ${remoteTag}\n`);
   if (prep.appConfig?.regions) {
-    process.stderr.write(`  ${fmt.bold("Regions:")}    ${prep.appConfig.regions.join(", ")}\n`);
+    process.stderr.write(`  ${fmt.bold("Regions:")}  ${prep.appConfig.regions.join(", ")}\n`);
+  }
+  if (prep.appConfig?.sleepAfter) {
+    process.stderr.write(`  ${fmt.bold("Sleep:")}    ${prep.appConfig.sleepAfter}\n`);
+  }
+  if (prep.gatewayConfig?.enabled) {
+    process.stderr.write(`  ${fmt.bold("Gateway:")}  ${prep.gatewayConfig.hostname || fmt.dim("(no hostname)")}\n`);
   }
   process.stderr.write(`${fmt.dim("-".repeat(40))}\n`);
 
@@ -478,30 +436,32 @@ async function deployViaPortal(nameOrPath, path, options) {
   // 3. Build Docker image locally
   phase("Building image");
   status(`${localTag} for linux/amd64`);
-  dockerBuild(dockerPath, localTag, { platform: "linux/amd64" });
-
-  // 4. Docker login to portal + push (portal proxies to real registry)
-  // Docker handles layer caching - only pushes layers that are missing.
-  phase("Pushing image via portal");
-  status("Authenticating with portal registry...");
-  dockerLogin(portalHost, "user", portal.token);
-
-  status(`Pushing ${remoteTag}...`);
-  dockerTag(localTag, remoteTag);
-  dockerPush(remoteTag);
+  dockerBuild(dockerPath, localTag, { platform: "linux/amd64", dockerfile: options.dockerfile, secrets: options.buildSecret });
 
-  // 5. Get the real image tag from portal (mapped to destination registry)
-  // The manifest push returns the real imageTag via the prepare endpoint
+  // 4. Push image to registry
   var imageTag;
-  try {
-    var tagInfo = await portalApi("POST", `/deploy/${name}/prepare`);
-    // Use the tag we pushed - portal knows the mapping
-    imageTag = remoteTag;
-  } catch {
+  if (prep.cfRegistry) {
+    // CF compute: push directly to CF Registry
+    phase("Pushing to CF Registry");
+    var cfr = prep.cfRegistry;
+    var cfTag = cfr.imageTag.replace(/:latest$/, `:${tag}`);
+    dockerLogin(cfr.registry, cfr.username, cfr.password);
+    dockerTag(localTag, cfTag);
+    status(`Pushing ${cfTag}...`);
+    dockerPush(cfTag);
+    imageTag = cfTag;
+  } else {
+    // Non-CF compute: push via portal OCI proxy
+    phase("Pushing image via portal");
+    status("Authenticating with portal registry...");
+    dockerLogin(portalHost, "user", portal.token);
+    status(`Pushing ${remoteTag}...`);
+    dockerTag(localTag, remoteTag);
+    dockerPush(remoteTag);
     imageTag = remoteTag;
   }
 
-  // 6. Tell portal to deploy
+  // 5. Trigger deployment
   phase("Deploying via portal");
   var result;
   try {
@@ -510,7 +470,7 @@ async function deployViaPortal(nameOrPath, path, options) {
     fatal(`Portal deploy failed: ${err.message}`);
   }
 
-  // 7. Report
+  // 6. Report
   if (options.json) {
     console.log(JSON.stringify({ name, imageTag, deploymentId: result.deployment?.id, status: result.deployment?.status }, null, 2));
   } else {
@@ -521,13 +481,7 @@ async function deployViaPortal(nameOrPath, path, options) {
     hint("Check status", `relight deploy status ${name}`);
   }
 
-  linkApp(
-    name,
-    providerNames.compute,
-    providerNames.dns,
-    undefined,
-    providerNames.registry
-  );
+  linkApp(name, null, null, undefined, null);
 }
 
 // --- Pre-deploy: run command inside built image with production env vars ---
diff --git a/src/commands/portals.js b/src/commands/portals.js
index 8be8eee..e778f19 100644
--- a/src/commands/portals.js
+++ b/src/commands/portals.js
@@ -75,3 +75,50 @@ export async function portalsRemove() {
   removePortal();
   success("Portal disconnected.");
 }
+
+export async function portalsDefaults(args) {
+  if (!args || args.length === 0) {
+    var data = await portalApi("GET", "/settings/defaults");
+    process.stderr.write(`${fmt.bold("Portal defaults:")}\n`);
+    process.stderr.write(`  ${fmt.bold("compute:")}           ${data.compute || fmt.dim("(none)")}\n`);
+    process.stderr.write(`  ${fmt.bold("db:")}                ${data.db || fmt.dim("(none)")}\n`);
+    process.stderr.write(`  ${fmt.bold("registry:")}          ${data.registry || fmt.dim("(none)")}\n`);
+    process.stderr.write(`  ${fmt.bold("gateway_enabled:")}   ${data.gateway_enabled}\n`);
+    process.stderr.write(`  ${fmt.bold("sm_connection:")}     ${data.sm_connection_label || fmt.dim("(none)")}\n`);
+    return;
+  }
+
+  // relight portals defaults set KEY=VAL ...
+  if (args[0] === "set") {
+    var pairs = args.slice(1);
+    if (pairs.length === 0) {
+      fatal("Usage: relight portals defaults set KEY=VALUE ...");
+    }
+
+    var update = {};
+    var VALID = { compute: 1, db: 1, registry: 1, gateway_enabled: 1, sm_connection_label: 1, gateway: 1 };
+    for (var pair of pairs) {
+      var eq = pair.indexOf("=");
+      if (eq === -1) fatal(`Invalid format: ${pair}. Expected KEY=VALUE.`);
+      var k = pair.substring(0, eq);
+      var v = pair.substring(eq + 1);
+      if (k === "gateway") k = "gateway_enabled";
+      if (!VALID[k]) fatal(`Unknown key: ${k}. Valid keys: compute, db, registry, gateway_enabled, sm_connection_label`);
+      if (k === "gateway_enabled") {
+        update[k] = v === "true" || v === "1" || v === "yes";
+      } else {
+        update[k] = v || null;
+      }
+    }
+
+    var result = await portalApi("PATCH", "/settings/defaults", update);
+    success("Portal defaults updated.");
+    process.stderr.write(`  ${fmt.bold("compute:")}           ${result.compute || fmt.dim("(none)")}\n`);
+    process.stderr.write(`  ${fmt.bold("db:")}                ${result.db || fmt.dim("(none)")}\n`);
+    process.stderr.write(`  ${fmt.bold("registry:")}          ${result.registry || fmt.dim("(none)")}\n`);
+    process.stderr.write(`  ${fmt.bold("gateway_enabled:")}   ${result.gateway_enabled}\n`);
+    process.stderr.write(`  ${fmt.bold("sm_connection:")}     ${result.sm_connection_label || fmt.dim("(none)")}\n`);
+  } else {
+    fatal("Usage: relight portals defaults [set KEY=VALUE ...]");
+  }
+}
diff --git a/src/commands/providers.js b/src/commands/providers.js
index 3bbe091..e6d002a 100644
--- a/src/commands/providers.js
+++ b/src/commands/providers.js
@@ -30,6 +30,7 @@ import { verifyConnection } from "../lib/clouds/slicervm.js";
 import { verifyApiKey } from "../lib/clouds/neon.js";
 import { verifyApiToken as verifyTursoToken } from "../lib/clouds/turso.js";
 import { verifyCredentials as verifyGHCR } from "../lib/clouds/ghcr.js";
+import { verifyToken as verifyDO } from "../lib/clouds/do.js";
 import kleur from "kleur";
 
 function prompt(rl, question) {
@@ -56,6 +57,8 @@ function normalizeType(input) {
     slicer: "slicervm",
     neon: "neon",
     turso: "turso",
+    do: "do",
+    digitalocean: "do",
   };
   return aliases[input.toLowerCase()] || input.toLowerCase();
 }
@@ -157,6 +160,9 @@ export async function providersAdd(typeName) {
     case "turso":
       providerConfig = await authTurso(rl);
       break;
+    case "do":
+      providerConfig = await authDO(rl);
+      break;
   }
 
   providerConfig.type = typeName;
@@ -764,3 +770,41 @@ async function authTurso(rl) {
 
   return { apiToken, orgSlug };
 }
+
+async function authDO(rl) {
+  process.stderr.write(`\n  ${kleur.bold("DigitalOcean API token")}\n\n`);
+  process.stderr.write(
+    `  ${fmt.dim("Get your API token at https://cloud.digitalocean.com/account/api/tokens")}\n\n`
+  );
+
+  var apiToken = await prompt(rl, "API token: ");
+  apiToken = (apiToken || "").trim();
+  if (!apiToken) {
+    rl.close();
+    fatal("No API token provided.");
+  }
+
+  process.stderr.write("\nVerifying...\n");
+  try {
+    await verifyDO(apiToken);
+  } catch (e) {
+    rl.close();
+    fatal("Authentication failed.", e.message);
+  }
+
+  process.stderr.write(`\n  ${kleur.bold("Database cluster UUID")}\n\n`);
+  process.stderr.write(
+    `  ${fmt.dim("Find it at https://cloud.digitalocean.com/databases → select cluster → Settings tab")}\n\n`
+  );
+
+  var clusterId = await prompt(rl, "Cluster UUID: ");
+  clusterId = (clusterId || "").trim();
+  if (!clusterId) {
+    rl.close();
+    fatal("No cluster UUID provided.");
+  }
+
+  process.stderr.write(`  Authenticated. Cluster: ${fmt.bold(clusterId)}\n`);
+
+  return { apiToken, clusterId };
+}
diff --git a/src/commands/scale.js b/src/commands/scale.js
index 007b063..3123615 100644
--- a/src/commands/scale.js
+++ b/src/commands/scale.js
@@ -1,9 +1,114 @@
 import { success, fatal, fmt } from "../lib/output.js";
 import { resolveAppName } from "../lib/link.js";
 import { resolveStack } from "../lib/providers/resolve.js";
+import { getPortal, portalApi, getPortalAppByName } from "../lib/portal.js";
+import { VALID_HINTS } from "../lib/providers/cf/app.js";
+
+function formatScaleJson(appConfig) {
+  return {
+    regions: appConfig.regions,
+    instances: appConfig.instances,
+    instanceType: appConfig.instanceType,
+    vcpu: appConfig.vcpu,
+    memory: appConfig.memory,
+    disk: appConfig.disk,
+    sleepAfter: appConfig.sleepAfter,
+  };
+}
+
+function printScaleSummary(name, appConfig) {
+  console.log(`\n${fmt.bold("App:")}        ${fmt.app(name)}`);
+  console.log(`${fmt.bold("Regions:")}    ${(appConfig.regions || []).join(", ")}`);
+  console.log(`${fmt.bold("Instances:")}  ${appConfig.instances} per region`);
+  if (appConfig.vcpu || appConfig.memory || appConfig.disk) {
+    if (appConfig.vcpu) console.log(`${fmt.bold("vCPU:")}       ${appConfig.vcpu}`);
+    if (appConfig.memory) console.log(`${fmt.bold("Memory:")}     ${appConfig.memory} MiB`);
+    if (appConfig.disk) console.log(`${fmt.bold("Disk:")}       ${appConfig.disk} MB`);
+  } else {
+    console.log(`${fmt.bold("Type:")}       ${appConfig.instanceType || "lite"}`);
+  }
+  if (appConfig.sleepAfter) {
+    console.log(`${fmt.bold("Sleep:")}      ${appConfig.sleepAfter}`);
+  }
+  console.log(
+    `\n${fmt.dim("Geo-routing is automatic - requests route to the closest deployed region.")}`
+  );
+}
+
+function buildScalePatch(options) {
+  var patch = {};
+  if (options.regions) patch.regions = options.regions;
+  if (options.instances) patch.instances = options.instances;
+  if (options.instanceType) patch.instanceType = options.instanceType;
+  if (options.vcpu) patch.vcpu = options.vcpu;
+  if (options.memory) patch.memory = options.memory;
+  if (options.disk) patch.disk = options.disk;
+  if (options.sleep) patch.sleep = options.sleep;
+  return patch;
+}
+
+async function scaleViaPortal(name, options) {
+  var patch = buildScalePatch(options);
+  var changed = Object.keys(patch).length > 0;
+
+  if (!changed) {
+    var app = await getPortalAppByName(name);
+    if (!app) {
+      fatal(
+        `App ${fmt.app(name)} not found.`,
+        `Run ${fmt.cmd(`relight deploy ${name} .`)} first.`
+      );
+    }
+    var appConfig = Object.assign({}, app.config || {}, app.liveInfo?.appConfig || {});
+    if (options.json) {
+      console.log(JSON.stringify(formatScaleJson(appConfig), null, 2));
+      return;
+    }
+    printScaleSummary(name, appConfig);
+    return;
+  }
+
+  if (patch.regions) {
+    var regions = patch.regions.split(",").map((r) => r.trim().toLowerCase());
+    for (var r of regions) {
+      if (!VALID_HINTS.includes(r)) {
+        fatal(
+          `Invalid location hint '${r}'.`,
+          `Valid hints: ${VALID_HINTS.join(", ")}`
+        );
+      }
+    }
+  }
+
+  var result = await portalApi("PATCH", `/apps/${name}/scale`, patch).catch((err) => {
+    fatal(err.message);
+  });
+
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  success(`Scaled ${fmt.app(name)} (live).`);
+  process.stderr.write(`  Regions:    ${(result.regions || []).join(", ")}\n`);
+  process.stderr.write(`  Instances:  ${result.instances}\n`);
+  if (result.vcpu || result.memory || result.disk) {
+    if (result.vcpu) process.stderr.write(`  vCPU:       ${result.vcpu}\n`);
+    if (result.memory) process.stderr.write(`  Memory:     ${result.memory} MiB\n`);
+    if (result.disk) process.stderr.write(`  Disk:       ${result.disk} MB\n`);
+  } else {
+    process.stderr.write(`  Type:       ${result.instanceType || "lite"}\n`);
+  }
+  if (result.sleepAfter) process.stderr.write(`  Sleep:      ${result.sleepAfter}\n`);
+}
 
 export async function scale(name, options) {
   name = resolveAppName(name);
+
+  if (!options.compute && getPortal()) {
+    return scaleViaPortal(name, options);
+  }
+
   var stack = await resolveStack(options);
   var { cfg, provider: appProvider } = stack.app;
 
@@ -61,60 +166,24 @@ export async function scale(name, options) {
     delete appConfig.instanceType;
     changed = true;
   }
+  if (options.sleep) {
+    appConfig.sleepAfter = options.sleep;
+    changed = true;
+  }
 
   if (!changed) {
-    // Show current scale
     if (options.json) {
-      console.log(
-        JSON.stringify(
-          {
-            regions: appConfig.regions,
-            instances: appConfig.instances,
-            instanceType: appConfig.instanceType,
-            vcpu: appConfig.vcpu,
-            memory: appConfig.memory,
-            disk: appConfig.disk,
-          },
-          null,
-          2
-        )
-      );
+      console.log(JSON.stringify(formatScaleJson(appConfig), null, 2));
       return;
     }
-
-    console.log(`\n${fmt.bold("App:")}        ${fmt.app(name)}`);
-    console.log(`${fmt.bold("Regions:")}    ${appConfig.regions.join(", ")}`);
-    console.log(`${fmt.bold("Instances:")}  ${appConfig.instances} per region`);
-    if (appConfig.vcpu || appConfig.memory || appConfig.disk) {
-      if (appConfig.vcpu) console.log(`${fmt.bold("vCPU:")}       ${appConfig.vcpu}`);
-      if (appConfig.memory) console.log(`${fmt.bold("Memory:")}     ${appConfig.memory} MiB`);
-      if (appConfig.disk) console.log(`${fmt.bold("Disk:")}       ${appConfig.disk} MB`);
-    } else {
-      console.log(`${fmt.bold("Type:")}       ${appConfig.instanceType || "lite"}`);
-    }
-    console.log(
-      `\n${fmt.dim("Geo-routing is automatic - requests route to the closest deployed region.")}`
-    );
+    printScaleSummary(name, appConfig);
     return;
   }
 
   await appProvider.scale(cfg, name, { appConfig });
 
   if (options.json) {
-    console.log(
-      JSON.stringify(
-        {
-          regions: appConfig.regions,
-          instances: appConfig.instances,
-          instanceType: appConfig.instanceType,
-          vcpu: appConfig.vcpu,
-          memory: appConfig.memory,
-          disk: appConfig.disk,
-        },
-        null,
-        2
-      )
-    );
+    console.log(JSON.stringify(formatScaleJson(appConfig), null, 2));
     return;
   }
 
@@ -128,4 +197,5 @@ export async function scale(name, options) {
   } else {
     process.stderr.write(`  Type:       ${appConfig.instanceType || "lite"}\n`);
   }
+  if (appConfig.sleepAfter) process.stderr.write(`  Sleep:      ${appConfig.sleepAfter}\n`);
 }
diff --git a/src/commands/secrets.js b/src/commands/secrets.js
new file mode 100644
index 0000000..23da9b0
--- /dev/null
+++ b/src/commands/secrets.js
@@ -0,0 +1,152 @@
+import { createInterface } from "readline";
+import { phase, success, fatal, hint, fmt } from "../lib/output.js";
+import { portalApi, getPortal } from "../lib/portal.js";
+import { resolveAppName } from "../lib/link.js";
+
+function prompt(rl, question) {
+  return new Promise((resolve) => rl.question(question, resolve));
+}
+
+// relight secrets list [app]
+export async function secretsList(appName, options) {
+  appName = appName || resolveAppName(options);
+  if (!appName) fatal("App name required. Run inside a linked directory or provide app name.");
+
+  var data = await portalApi("GET", `/apps/${appName}/secrets`).catch((err) => {
+    fatal(err.message);
+  });
+
+  if (data.keys.length === 0) {
+    process.stderr.write(`No secrets configured for ${fmt.app(appName)}.\n`);
+    return;
+  }
+
+  process.stderr.write(`${fmt.bold(`Secrets for ${fmt.app(appName)}:`)}\n`);
+  for (var key of data.keys) {
+    process.stderr.write(`  ${key}\n`);
+  }
+  process.stderr.write(`\n${fmt.dim(`${data.keys.length} secret(s) (values hidden)`)}\n`);
+}
+
+// relight secrets push [app] KEY=VAL ...
+export async function secretsPush(args, options) {
+  var appName;
+  var pairs;
+
+  // Check if first arg looks like KEY=VALUE or just a name
+  if (args.length > 0 && args[0].includes("=")) {
+    appName = resolveAppName(options);
+    pairs = args;
+  } else {
+    appName = args[0];
+    pairs = args.slice(1);
+  }
+
+  if (!appName) fatal("App name required.");
+  if (pairs.length === 0) fatal("No secrets provided. Usage: relight secrets push [app] KEY=VALUE ...");
+
+  var secrets = {};
+  for (var pair of pairs) {
+    var eq = pair.indexOf("=");
+    if (eq === -1) fatal(`Invalid format: ${pair}. Expected KEY=VALUE.`);
+    secrets[pair.substring(0, eq)] = pair.substring(eq + 1);
+  }
+
+  await portalApi("POST", `/apps/${appName}/secrets`, secrets).catch((err) => {
+    fatal(err.message);
+  });
+
+  success(`${Object.keys(secrets).length} secret(s) pushed to ${fmt.app(appName)}.`);
+}
+
+// relight secrets sync [app] — fetch from SM and push to CF Worker bindings
+export async function secretsSync(appName, options) {
+  appName = appName || resolveAppName(options);
+  if (!appName) fatal("App name required.");
+
+  var data = await portalApi("POST", `/apps/${appName}/secrets/sync`).catch((err) => {
+    fatal(err.message);
+  });
+
+  success(`Synced ${data.synced} secret(s) to ${fmt.app(appName)} worker.`);
+  for (var key of data.keys || []) {
+    process.stderr.write(`  ${key}\n`);
+  }
+  if (data.hyperdriveId) {
+    hint("Hyperdrive", data.hyperdriveId);
+  }
+  hint("Restart container", `curl your gateway URL to cold-start a new instance`);
+}
+
+// relight secrets delete [app] KEY
+export async function secretsDelete(args, options) {
+  var appName;
+  var key;
+
+  if (args.length === 1) {
+    appName = resolveAppName(options);
+    key = args[0];
+  } else {
+    appName = args[0];
+    key = args[1];
+  }
+
+  if (!appName) fatal("App name required.");
+  if (!key) fatal("Secret key required.");
+
+  await portalApi("DELETE", `/apps/${appName}/secrets/${key}`).catch((err) => {
+    fatal(err.message);
+  });
+
+  success(`Secret ${fmt.bold(key)} deleted from ${fmt.app(appName)}.`);
+}
+
+// relight secrets configure [app] — interactive setup of sm_* fields
+export async function secretsConfigure(appName, options) {
+  appName = appName || resolveAppName(options);
+  if (!appName) fatal("App name required.");
+
+  // Try to prefill from portal defaults
+  var portalDefaults = null;
+  try {
+    portalDefaults = await portalApi("GET", "/settings/defaults");
+  } catch {}
+
+  var rl = createInterface({ input: process.stdin, output: process.stderr });
+
+  process.stderr.write(`\n${fmt.bold(`Configure secret manager for ${fmt.app(appName)}`)}\n\n`);
+  process.stderr.write(`${fmt.dim("Provider-agnostic fields. For Infisical: connection label = SECRETS_<LABEL> env var prefix.")}\n\n`);
+
+  var defaultLabel = portalDefaults?.sm_connection_label || "infisical";
+
+  var connLabel = await prompt(rl, `Connection label [${defaultLabel}]: `);
+  connLabel = (connLabel || "").trim() || defaultLabel;
+
+  var projectId = await prompt(rl, "Project ID (workspace / mount path): ");
+  projectId = (projectId || "").trim();
+  if (!projectId) {
+    rl.close();
+    fatal("Project ID is required.");
+  }
+
+  var env = await prompt(rl, "Environment [production]: ");
+  env = (env || "").trim() || "production";
+
+  var path = await prompt(rl, "Secret path [/]: ");
+  path = (path || "").trim() || "/";
+
+  rl.close();
+
+  await portalApi("PATCH", `/apps/${appName}/secret-manager`, {
+    connection_label: connLabel,
+    project_id: projectId,
+    environment: env,
+    path,
+  }).catch((err) => {
+    fatal(err.message);
+  });
+
+  success(`Secret manager configured for ${fmt.app(appName)}.`);
+  hint("Push secrets", `relight secrets push ${appName} KEY=VALUE ...`);
+  hint("List keys", `relight secrets list ${appName}`);
+}
diff --git a/src/commands/service.js b/src/commands/service.js
deleted file mode 100644
index c72ab05..0000000
--- a/src/commands/service.js
+++ /dev/null
@@ -1,279 +0,0 @@
-import { createInterface } from "readline";
-import { success, fatal, fmt, table } from "../lib/output.js";
-import {
-  SERVICE_TYPES,
-  getRegisteredServices,
-  saveServiceConfig,
-  removeServiceConfig,
-  normalizeServiceConfig,
-  tryGetServiceConfig,
-} from "../lib/config.js";
-import { verifyConnection } from "../lib/clouds/slicervm.js";
-import { verifyApiKey } from "../lib/clouds/neon.js";
-import { verifyApiToken as verifyTursoToken } from "../lib/clouds/turso.js";
-import kleur from "kleur";
-
-function prompt(rl, question) {
-  return new Promise((resolve) => rl.question(question, resolve));
-}
-
-export async function serviceList() {
-  var services = getRegisteredServices();
-
-  if (services.length === 0) {
-    process.stderr.write("No services registered.\n");
-    process.stderr.write(
-      `\n${fmt.dim("Hint:")} ${fmt.cmd("relight services add")} to register one.\n`
-    );
-    return;
-  }
-
-  var headers = ["NAME", "LAYER", "TYPE", "ENDPOINT"];
-  var rows = services.map((a) => [
-    fmt.bold(a.name),
-    a.layer,
-    SERVICE_TYPES[a.type]?.name || a.type,
-    a.socketPath || a.apiUrl || (a.type === "neon" ? "console.neon.tech" : a.type === "turso" ? "turso.io" : "-"),
-  ]);
-
-  console.log(table(headers, rows));
-}
-
-export async function serviceAdd(name) {
-  var rl = createInterface({ input: process.stdin, output: process.stderr });
-
-  // 1. Pick layer
-  var layers = ["compute", "db"];
-  process.stderr.write(`\n${kleur.bold("Register a service")}\n\n`);
-  process.stderr.write(`  ${kleur.bold("Layer:")}\n\n`);
-  for (var i = 0; i < layers.length; i++) {
-    process.stderr.write(`  ${kleur.bold(`[${i + 1}]`)} ${layers[i]}\n`);
-  }
-  process.stderr.write("\n");
-
-  var layerChoice = await prompt(rl, `Select layer [1-${layers.length}]: `);
-  var layerIdx = parseInt(layerChoice, 10) - 1;
-  if (isNaN(layerIdx) || layerIdx < 0 || layerIdx >= layers.length) {
-    rl.close();
-    fatal("Invalid selection.");
-  }
-  var layer = layers[layerIdx];
-
-  // 2. Pick type (contextual to layer)
-  var types = Object.entries(SERVICE_TYPES)
-    .filter(([, v]) => v.layer === layer)
-    .map(([id, v]) => ({ id, name: v.name }));
-
-  process.stderr.write(`\n  ${kleur.bold("Type:")}\n\n`);
-  for (var i = 0; i < types.length; i++) {
-    process.stderr.write(
-      `  ${kleur.bold(`[${i + 1}]`)} ${types[i].name}\n`
-    );
-  }
-  process.stderr.write("\n");
-
-  var typeChoice = await prompt(rl, `Select type [1-${types.length}]: `);
-  var typeIdx = parseInt(typeChoice, 10) - 1;
-  if (isNaN(typeIdx) || typeIdx < 0 || typeIdx >= types.length) {
-    rl.close();
-    fatal("Invalid selection.");
-  }
-  var serviceType = types[typeIdx].id;
-
-  // 3. Connection details (SlicerVM-specific)
-  var config = { layer, type: serviceType };
-
-  if (serviceType === "slicervm") {
-    process.stderr.write(`\n  ${kleur.bold("Connection mode")}\n\n`);
-    process.stderr.write(`  ${kleur.bold("[1]")} Unix socket (local dev)\n`);
-    process.stderr.write(`  ${kleur.bold("[2]")} HTTP API (remote)\n\n`);
-
-    var modeChoice = await prompt(rl, "Select [1-2]: ");
-    var useSocket = modeChoice.trim() === "1";
-
-    if (useSocket) {
-      var defaultSocket = "/var/run/slicer/slicer.sock";
-      var socketPath = await prompt(rl, `Socket path [${defaultSocket}]: `);
-      socketPath = (socketPath || "").trim() || defaultSocket;
-      config.socketPath = socketPath;
-    } else {
-      var apiUrl = await prompt(
-        rl,
-        "Slicer API URL (e.g. https://slicer.example.com:8080): "
-      );
-      apiUrl = (apiUrl || "").trim().replace(/\/+$/, "");
-      if (!apiUrl) {
-        rl.close();
-        fatal("No API URL provided.");
-      }
-      config.apiUrl = apiUrl;
-
-      var token = await prompt(rl, "API token: ");
-      token = (token || "").trim();
-      if (!token) {
-        rl.close();
-        fatal("No token provided.");
-      }
-      config.token = token;
-    }
-
-    var hostGroup = await prompt(rl, "Host group [apps]: ");
-    config.hostGroup = (hostGroup || "").trim() || "apps";
-
-    var baseDomain = await prompt(
-      rl,
-      "Base domain (e.g. apps.example.com) [localhost]: "
-    );
-    config.baseDomain = (baseDomain || "").trim() || "localhost";
-
-    // 4. Verify connection
-    process.stderr.write("\nVerifying...\n");
-    var verifyCfg = normalizeServiceConfig(config);
-    try {
-      await verifyConnection(verifyCfg);
-    } catch (e) {
-      rl.close();
-      fatal("Connection failed.", e.message);
-    }
-
-    if (useSocket) {
-      process.stderr.write(`  Socket: ${fmt.bold(config.socketPath)}\n`);
-    } else {
-      process.stderr.write(`  API: ${fmt.bold(config.apiUrl)}\n`);
-    }
-    process.stderr.write(`  Host group: ${fmt.dim(config.hostGroup)}\n`);
-    process.stderr.write(`  Base domain: ${fmt.dim(config.baseDomain)}\n`);
-  } else if (serviceType === "neon") {
-    process.stderr.write(`\n  ${kleur.bold("Neon API key")}\n\n`);
-    process.stderr.write(
-      `  ${fmt.dim("Get your API key at https://console.neon.tech/app/settings/api-keys")}\n\n`
-    );
-
-    var apiKey = await prompt(rl, "API key: ");
-    apiKey = (apiKey || "").trim();
-    if (!apiKey) {
-      rl.close();
-      fatal("No API key provided.");
-    }
-    config.apiKey = apiKey;
-
-    // Verify connection
-    process.stderr.write("\nVerifying...\n");
-    try {
-      var projects = await verifyApiKey(apiKey);
-      process.stderr.write(
-        `  Authenticated. ${projects.length} existing project${projects.length === 1 ? "" : "s"}.\n`
-      );
-    } catch (e) {
-      rl.close();
-      fatal("Authentication failed.", e.message);
-    }
-  } else if (serviceType === "turso") {
-    process.stderr.write(`\n  ${kleur.bold("Turso API token")}\n\n`);
-    process.stderr.write(
-      `  ${fmt.dim("Get your API token at https://turso.tech/app/settings/api-tokens")}\n\n`
-    );
-
-    var apiToken = await prompt(rl, "API token: ");
-    apiToken = (apiToken || "").trim();
-    if (!apiToken) {
-      rl.close();
-      fatal("No API token provided.");
-    }
-    config.apiToken = apiToken;
-
-    // Verify connection and get orgs
-    process.stderr.write("\nVerifying...\n");
-    var orgs;
-    try {
-      orgs = await verifyTursoToken(apiToken);
-    } catch (e) {
-      rl.close();
-      fatal("Authentication failed.", e.message);
-    }
-
-    if (orgs.length === 0) {
-      rl.close();
-      fatal("No organizations found for this API token.");
-    }
-
-    var orgSlug;
-    if (orgs.length === 1) {
-      orgSlug = orgs[0].slug || orgs[0].name;
-      process.stderr.write(`  Organization: ${fmt.bold(orgSlug)}\n`);
-    } else {
-      process.stderr.write(`\n  ${kleur.bold("Select organization:")}\n\n`);
-      for (var i = 0; i < orgs.length; i++) {
-        var slug = orgs[i].slug || orgs[i].name;
-        process.stderr.write(`  ${kleur.bold(`[${i + 1}]`)} ${slug}\n`);
-      }
-      process.stderr.write("\n");
-      var orgChoice = await prompt(rl, `Select [1-${orgs.length}]: `);
-      var orgIdx = parseInt(orgChoice, 10) - 1;
-      if (isNaN(orgIdx) || orgIdx < 0 || orgIdx >= orgs.length) {
-        rl.close();
-        fatal("Invalid selection.");
-      }
-      orgSlug = orgs[orgIdx].slug || orgs[orgIdx].name;
-    }
-
-    config.orgSlug = orgSlug;
-    process.stderr.write(`  Authenticated with ${fmt.bold(orgSlug)}.\n`);
-  }
-
-  // 5. Auto-name if not provided
-  if (!name) {
-    var existing = getRegisteredServices().filter((a) => a.type === serviceType);
-    if (existing.length === 0) {
-      name = serviceType;
-    } else {
-      name = `${serviceType}-${existing.length + 1}`;
-    }
-    var inputName = await prompt(rl, `Service name [${name}]: `);
-    name = (inputName || "").trim() || name;
-  }
-
-  // Check for existing
-  if (tryGetServiceConfig(name)) {
-    var overwrite = await prompt(
-      rl,
-      `Service '${name}' already exists. Overwrite? [y/N] `
-    );
-    if (!overwrite.match(/^y(es)?$/i)) {
-      rl.close();
-      process.stderr.write("Cancelled.\n");
-      process.exit(0);
-    }
-  }
-
-  rl.close();
-
-  // 6. Save
-  saveServiceConfig(name, config);
-
-  success(`Service ${fmt.bold(name)} registered!`);
-}
-
-export async function serviceRemove(name) {
-  if (!name) {
-    fatal("Usage: relight services remove <name>");
-  }
-
-  if (!tryGetServiceConfig(name)) {
-    fatal(`Service '${name}' not found.`);
-  }
-
-  var rl = createInterface({ input: process.stdin, output: process.stderr });
-  var answer = await new Promise((resolve) =>
-    rl.question(`Remove service '${name}'? [y/N] `, resolve)
-  );
-  rl.close();
-
-  if (!answer.match(/^y(es)?$/i)) {
-    process.stderr.write("Cancelled.\n");
-    return;
-  }
-
-  removeServiceConfig(name);
-  success(`Service ${fmt.bold(name)} removed.`);
-}
diff --git a/src/commands/ssh-keys.js b/src/commands/ssh-keys.js
new file mode 100644
index 0000000..e1a70d0
--- /dev/null
+++ b/src/commands/ssh-keys.js
@@ -0,0 +1,69 @@
+import { success, fatal, fmt, table } from "../lib/output.js";
+import { portalApi, getPortalAppByName } from "../lib/portal.js";
+import { resolveAppName } from "../lib/link.js";
+
+// relight ssh-keys list [app]
+export async function sshKeysList(appName, options) {
+  appName = appName || resolveAppName(options);
+  if (!appName) fatal("App name required. Run inside a linked directory or provide app name.");
+
+  var app = await getPortalAppByName(appName);
+  if (!app) fatal(`App ${fmt.app(appName)} not found.`);
+  var keys = app.liveInfo?.appConfig?.sshKeys || app.config?.sshKeys || [];
+
+  if (keys.length === 0) {
+    process.stderr.write(`No SSH keys configured for ${fmt.app(appName)}.\n`);
+    return;
+  }
+
+  var rows = keys.map((k) => [k.name, k.public_key.slice(0, 60) + "…"]);
+  console.log(table(["NAME", "PUBLIC KEY"], rows));
+}
+
+// relight ssh-keys add [app] <name> <public-key>
+export async function sshKeysAdd(args, options) {
+  var appName, keyName, publicKey;
+
+  if (args.length >= 3) {
+    [appName, keyName, publicKey] = args;
+  } else if (args.length === 2) {
+    appName = resolveAppName(options);
+    [keyName, publicKey] = args;
+  } else {
+    fatal("Usage: relight ssh-keys add [app] <name> <public-key>");
+  }
+
+  if (!appName) fatal("App name required.");
+  if (!publicKey || !publicKey.startsWith("ssh-ed25519 ")) {
+    fatal("Only ssh-ed25519 keys are supported by Cloudflare Containers.");
+  }
+
+  await portalApi("PATCH", `/apps/${appName}/ssh-keys`, {
+    add: { name: keyName, public_key: publicKey },
+  }).catch((err) => fatal(err.message));
+
+  success(`SSH key "${keyName}" added to ${fmt.app(appName)}. Container rollout triggered.`);
+  process.stderr.write(fmt.dim(`Connect: npx wrangler containers ssh <INSTANCE_ID>\n`));
+}
+
+// relight ssh-keys remove [app] <name>
+export async function sshKeysRemove(args, options) {
+  var appName, keyName;
+
+  if (args.length >= 2) {
+    [appName, keyName] = args;
+  } else if (args.length === 1) {
+    appName = resolveAppName(options);
+    keyName = args[0];
+  } else {
+    fatal("Usage: relight ssh-keys remove [app] <name>");
+  }
+
+  if (!appName) fatal("App name required.");
+
+  await portalApi("PATCH", `/apps/${appName}/ssh-keys`, {
+    remove: keyName,
+  }).catch((err) => fatal(err.message));
+
+  success(`SSH key "${keyName}" removed from ${fmt.app(appName)}. Container rollout triggered.`);
+}
diff --git a/src/lib/clouds/cf.js b/src/lib/clouds/cf.js
index 8398a4c..97d6038 100644
--- a/src/lib/clouds/cf.js
+++ b/src/lib/clouds/cf.js
@@ -10,8 +10,10 @@ export var TOKEN_URL =
     JSON.stringify([
       { key: "workers_scripts", type: "edit" },
       { key: "containers", type: "edit" },
+      { key: "hyperdrive", type: "edit" },
       { key: "zone", type: "read" },
       { key: "dns", type: "edit" },
+      { key: "workers_routes", type: "edit" },
     ])
   ) +
   "&name=relight-cli";
@@ -126,6 +128,35 @@ export async function uploadWorker(accountId, apiToken, scriptName, code, metada
   return res.json();
 }
 
+export async function uploadWorkerToDispatchNamespace(accountId, apiToken, namespace, scriptName, code, metadata) {
+  var form = new FormData();
+  form.append(
+    "metadata",
+    new Blob([JSON.stringify(metadata)], { type: "application/json" })
+  );
+  form.append(
+    "index.js",
+    new Blob([code], { type: "application/javascript+module" }),
+    "index.js"
+  );
+
+  var res = await fetch(
+    `${CF_API}/accounts/${accountId}/workers/dispatch/namespaces/${namespace}/scripts/${scriptName}`,
+    {
+      method: "PUT",
+      headers: { Authorization: `Bearer ${apiToken}` },
+      body: form,
+    }
+  );
+
+  if (!res.ok) {
+    var text = await res.text();
+    throw new Error(`Dispatch namespace worker upload failed: ${res.status} ${text}`);
+  }
+
+  return res.json();
+}
+
 export async function deleteWorker(accountId, apiToken, scriptName) {
   return cfApi(
     "DELETE",
@@ -135,6 +166,15 @@ export async function deleteWorker(accountId, apiToken, scriptName) {
   );
 }
 
+export async function deleteWorkerFromDispatchNamespace(accountId, apiToken, namespace, scriptName) {
+  return cfApi(
+    "DELETE",
+    `/accounts/${accountId}/workers/dispatch/namespaces/${namespace}/scripts/${scriptName}`,
+    null,
+    apiToken
+  );
+}
+
 export async function patchWorkerSettings(accountId, apiToken, scriptName, settings) {
   var form = new FormData();
   form.append(
@@ -338,6 +378,37 @@ export async function updateDnsRecord(accountId, apiToken, zoneId, recordId, rec
   );
 }
 
+// --- Zone-level Worker Routes ---
+
+export async function listWorkerRoutes(accountId, apiToken, zoneId) {
+  var res = await cfApi(
+    "GET",
+    `/zones/${zoneId}/workers/routes`,
+    null,
+    apiToken
+  );
+  return res.result || [];
+}
+
+export async function createWorkerRoute(accountId, apiToken, zoneId, pattern, scriptName) {
+  var res = await cfApi(
+    "POST",
+    `/zones/${zoneId}/workers/routes`,
+    { pattern, script: scriptName },
+    apiToken
+  );
+  return res.result;
+}
+
+export async function deleteWorkerRoute(accountId, apiToken, zoneId, routeId) {
+  return cfApi(
+    "DELETE",
+    `/zones/${zoneId}/workers/routes/${routeId}`,
+    null,
+    apiToken
+  );
+}
+
 // --- Workers custom domains ---
 
 export async function addWorkerDomain(accountId, apiToken, scriptName, hostname, zoneId) {
@@ -489,3 +560,30 @@ export async function importD1(accountId, apiToken, dbId, body) {
     apiToken
   );
 }
+
+// --- Hyperdrive ---
+
+export async function listHyperdriveConfigs(accountId, apiToken) {
+  var res = await cfApi("GET", `/accounts/${accountId}/hyperdrive/configs`, null, apiToken);
+  return res.result || [];
+}
+
+export async function createHyperdriveConfig(accountId, apiToken, name, origin) {
+  var res = await cfApi(
+    "POST",
+    `/accounts/${accountId}/hyperdrive/configs`,
+    { name, origin },
+    apiToken
+  );
+  return res.result;
+}
+
+export async function updateHyperdriveConfig(accountId, apiToken, id, name, origin) {
+  var res = await cfApi(
+    "PUT",
+    `/accounts/${accountId}/hyperdrive/configs/${id}`,
+    { name, origin },
+    apiToken
+  );
+  return res.result;
+}
diff --git a/src/lib/clouds/do.js b/src/lib/clouds/do.js
new file mode 100644
index 0000000..7b134c2
--- /dev/null
+++ b/src/lib/clouds/do.js
@@ -0,0 +1,87 @@
+var DO_API = "https://api.digitalocean.com/v2";
+
+export async function doApi(method, path, body, token) {
+  var headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json",
+  };
+
+  var res = await fetch(`${DO_API}${path}`, {
+    method,
+    headers,
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+
+  if (!res.ok) {
+    var text = await res.text();
+    throw new Error(`DO API ${method} ${path}: ${res.status} ${text}`);
+  }
+
+  if (res.status === 204) return null;
+  return res.json();
+}
+
+export async function verifyToken(token) {
+  return doApi("GET", "/account", undefined, token);
+}
+
+// --- Database cluster operations ---
+
+export async function getClusterConnection(token, clusterId) {
+  var res = await doApi("GET", `/databases/${clusterId}`, undefined, token);
+  var db = res.database;
+  return {
+    host: db.connection.host,
+    port: db.connection.port,
+    user: db.connection.user,
+    password: db.connection.password,
+    database: db.connection.database || "defaultdb",
+    sslmode: db.connection.ssl ? "require" : "disable",
+  };
+}
+
+export async function createDatabaseInCluster(token, clusterId, dbName) {
+  var res = await doApi(
+    "POST",
+    `/databases/${clusterId}/dbs`,
+    { name: dbName },
+    token
+  );
+  return res.db;
+}
+
+export async function deleteDatabaseInCluster(token, clusterId, dbName) {
+  return doApi("DELETE", `/databases/${clusterId}/dbs/${dbName}`, undefined, token);
+}
+
+export async function createUserInCluster(token, clusterId, userName) {
+  var res = await doApi(
+    "POST",
+    `/databases/${clusterId}/users`,
+    { name: userName },
+    token
+  );
+  return { name: res.user.name, password: res.user.password };
+}
+
+export async function deleteUserInCluster(token, clusterId, userName) {
+  return doApi("DELETE", `/databases/${clusterId}/users/${userName}`, undefined, token);
+}
+
+export async function getUserInCluster(token, clusterId, userName) {
+  try {
+    var res = await doApi("GET", `/databases/${clusterId}/users/${userName}`, undefined, token);
+    return res.user || null;
+  } catch {
+    return null;
+  }
+}
+
+export async function getDatabaseInCluster(token, clusterId, dbName) {
+  try {
+    var res = await doApi("GET", `/databases/${clusterId}/dbs/${dbName}`, undefined, token);
+    return res.db || null;
+  } catch {
+    return null;
+  }
+}
diff --git a/src/lib/config.js b/src/lib/config.js
index 4d6c92e..cb3dc51 100644
--- a/src/lib/config.js
+++ b/src/lib/config.js
@@ -12,7 +12,9 @@ export var PROVIDERS = {
   gcp: { name: "Google Cloud", layers: ["app", "db", "dns", "registry"] },
   aws: { name: "AWS", layers: ["app", "db", "dns", "registry"] },
   azure: { name: "Azure", layers: ["app", "db", "dns", "registry"] },
-  do: { name: "DigitalOcean", layers: ["db", "dns"] },
+  do: { name: "DigitalOcean", layers: ["db"] },
+  neon: { name: "Neon", layers: ["db"] },
+  turso: { name: "Turso", layers: ["db"] },
   ghcr: { name: "GitHub Container Registry", layers: ["registry"] },
   slicervm: { name: "SlicerVM", layers: ["app"] },
   demo: { name: "Demo (local)", layers: ["app", "db"] },
diff --git a/src/lib/docker.js b/src/lib/docker.js
index e9e0941..51766a6 100644
--- a/src/lib/docker.js
+++ b/src/lib/docker.js
@@ -12,9 +12,11 @@ function ensureDocker() {
 export function dockerBuild(contextPath, tag, opts = {}) {
   ensureDocker();
   var platform = opts.platform || "linux/amd64";
+  var fileFlag = opts.dockerfile ? `-f ${opts.dockerfile}` : "";
+  var secretFlags = (opts.secrets || []).map((s) => `--secret ${s}`).join(" ");
   execSync(
-    `docker build --platform ${platform} --provenance=false -t ${tag} ${contextPath}`,
-    { stdio: "pipe" }
+    `docker build --platform ${platform} --provenance=false ${fileFlag} ${secretFlags} -t ${tag} ${contextPath}`.replace(/\s+/g, " ").trim(),
+    { stdio: "inherit", env: { ...process.env, DOCKER_BUILDKIT: "1" } }
   );
 }
 
diff --git a/src/lib/portal.js b/src/lib/portal.js
index 872aa21..7429183 100644
--- a/src/lib/portal.js
+++ b/src/lib/portal.js
@@ -43,3 +43,12 @@ export async function portalApi(method, path, body) {
 
   return data;
 }
+
+export async function getPortalAppByName(name) {
+  var data = await portalApi("GET", "/apps");
+  var apps = data.apps ?? data;
+  var app = apps.find((a) => a.name === name);
+  if (!app) return null;
+  var detail = await portalApi("GET", `/apps/${app.id}`);
+  return detail.app;
+}
diff --git a/src/lib/providers/cf/app.js b/src/lib/providers/cf/app.js
index cc15b76..536d460 100644
--- a/src/lib/providers/cf/app.js
+++ b/src/lib/providers/cf/app.js
@@ -108,6 +108,15 @@ export function buildWorkerMetadata(appConfig, { firstDeploy = false, newSecrets
     }
   }
 
+  // System-level secrets injected by portal (not in appConfig.secretKeys)
+  if (newSecrets) {
+    for (var sysKey of ["GATEWAY_SECRET"]) {
+      if (newSecrets[sysKey] !== undefined && !secretKeys.includes(sysKey)) {
+        bindings.push({ type: "secret_text", name: sysKey, text: newSecrets[sysKey] });
+      }
+    }
+  }
+
   var metadata = {
     main_module: "index.js",
     compatibility_date: "2025-10-08",
@@ -139,6 +148,31 @@ export function buildWorkerMetadata(appConfig, { firstDeploy = false, newSecrets
 
 // --- Container config builder ---
 
+// During a rolling deploy CF starts new instances before stopping old ones.
+// Using step_percentage = floor(100/instances), CF replaces at most 1 instance
+// per region per step → peak = desired + regions (minimum headroom).
+function calcMaxInstances(appConfig) {
+  var regions = appConfig.regions?.length || 1;
+  var desired = regions * (appConfig.instances || 2);
+  return desired + regions;
+}
+
+function calcRolloutStepPercentage(appConfig) {
+  var instances = appConfig.instances || 2;
+  return Math.min(100, Math.floor(100 / instances));
+}
+
+// Map human-friendly / legacy instance type aliases to CF API enum values.
+// CF API accepts: lite | basic | standard-1 | standard-2 | standard-3 | standard-4 | standard | dev
+var INSTANCE_TYPE_ALIASES = {
+  base: "basic",
+  large: "standard-4",
+};
+function normalizeInstanceType(t) {
+  if (!t) return undefined;
+  return INSTANCE_TYPE_ALIASES[t] ?? t;
+}
+
 function buildContainerConfig(appConfig) {
   var cfg = {
     image: appConfig.image,
@@ -150,7 +184,7 @@ function buildContainerConfig(appConfig) {
     if (appConfig.memory) cfg.memory_mib = appConfig.memory;
     if (appConfig.disk) cfg.disk = { size_mb: appConfig.disk };
   } else {
-    cfg.instance_type = appConfig.instanceType || "lite";
+    cfg.instance_type = normalizeInstanceType(appConfig.instanceType) || "lite";
   }
 
   return cfg;
@@ -164,7 +198,6 @@ export async function deploy(cfg, appName, imageTag, opts) {
   var isFirstDeploy = opts.isFirstDeploy;
   var newSecrets = opts.newSecrets || {};
 
-  // Upload worker
   var currentHash = templateHash();
   var needsWorkerUpload = isFirstDeploy || appConfig.templateHash !== currentHash;
 
@@ -172,7 +205,16 @@ export async function deploy(cfg, appName, imageTag, opts) {
     var bundledCode = getWorkerBundle();
     appConfig.templateHash = currentHash;
     var metadata = buildWorkerMetadata(appConfig, { firstDeploy: isFirstDeploy, newSecrets });
-    await uploadWorker(cfg.accountId, cfg.apiToken, scriptName, bundledCode, metadata);
+    try {
+      await uploadWorker(cfg.accountId, cfg.apiToken, scriptName, bundledCode, metadata);
+    } catch (err) {
+      if (isFirstDeploy && err.message && err.message.includes("10079")) {
+        metadata = buildWorkerMetadata(appConfig, { firstDeploy: false, newSecrets });
+        await uploadWorker(cfg.accountId, cfg.apiToken, scriptName, bundledCode, metadata);
+      } else {
+        throw err;
+      }
+    }
   } else {
     await pushAppConfig(cfg, appName, appConfig, { newSecrets });
   }
@@ -184,7 +226,7 @@ export async function deploy(cfg, appName, imageTag, opts) {
   }
 
   var existingApp = await findContainerApp(cfg.accountId, cfg.apiToken, scriptName);
-  var maxInstances = (appConfig.regions?.length || 1) * (appConfig.instances || 2);
+  var maxInstances = calcMaxInstances(appConfig);
 
   if (existingApp) {
     if (existingApp.max_instances !== maxInstances) {
@@ -196,7 +238,7 @@ export async function deploy(cfg, appName, imageTag, opts) {
       description: `Deploy ${imageTag}`,
       strategy: "rolling",
       kind: "full_auto",
-      step_percentage: 100,
+      step_percentage: calcRolloutStepPercentage(appConfig),
       target_configuration: buildContainerConfig(appConfig),
     });
   } else {
@@ -212,7 +254,6 @@ export async function deploy(cfg, appName, imageTag, opts) {
     });
   }
 
-  // Enable workers.dev route
   try {
     await enableWorkerSubdomain(cfg.accountId, cfg.apiToken, scriptName);
   } catch {}
@@ -245,7 +286,7 @@ export async function getAppInfo(cfg, appName) {
 
 // --- Destroy ---
 
-export async function destroyApp(cfg, appName) {
+export async function destroyApp(cfg, appName, opts) {
   var scriptName = `relight-${appName}`;
 
   // Delete D1 database if attached
@@ -266,7 +307,6 @@ export async function destroyApp(cfg, appName) {
     }
   } catch {}
 
-  // Delete worker
   await deleteWorker(cfg.accountId, cfg.apiToken, scriptName);
 }
 
@@ -280,8 +320,7 @@ export async function scale(cfg, appName, opts) {
   var scriptName = `relight-${appName}`;
   var containerApp = await findContainerApp(cfg.accountId, cfg.apiToken, scriptName);
   if (containerApp) {
-    var maxInstances = (appConfig.regions?.length || 1) * (appConfig.instances || 2);
-    var modification = { max_instances: maxInstances };
+    var modification = { max_instances: calcMaxInstances(appConfig) };
 
     if (appConfig.vcpu || appConfig.memory || appConfig.disk) {
       modification.configuration = {};
@@ -289,7 +328,7 @@ export async function scale(cfg, appName, opts) {
       if (appConfig.memory) modification.configuration.memory_mib = appConfig.memory;
       if (appConfig.disk) modification.configuration.disk = { size_mb: appConfig.disk };
     } else if (appConfig.instanceType) {
-      modification.configuration = { instance_type: appConfig.instanceType };
+      modification.configuration = { instance_type: normalizeInstanceType(appConfig.instanceType) };
     }
 
     await modifyContainerApp(cfg.accountId, cfg.apiToken, containerApp.id, modification);
diff --git a/src/lib/providers/cf/bundle.js b/src/lib/providers/cf/bundle.js
index 469ba3d..0b036e3 100644
--- a/src/lib/providers/cf/bundle.js
+++ b/src/lib/providers/cf/bundle.js
@@ -13,7 +13,7 @@ import { homedir } from "os";
 import { fileURLToPath } from "url";
 
 var __dirname = dirname(fileURLToPath(import.meta.url));
-var templateDir = join(__dirname, "..", "..", "..", "worker-template");
+var templateDir = join(__dirname, "..", "..", "..", "..", "worker-template");
 var cacheDir = join(homedir(), ".relight");
 var bundlePath = join(cacheDir, "worker-bundle.js");
 var hashPath = join(cacheDir, "worker-bundle.hash");
diff --git a/src/lib/providers/do/db.js b/src/lib/providers/do/db.js
new file mode 100644
index 0000000..470eece
--- /dev/null
+++ b/src/lib/providers/do/db.js
@@ -0,0 +1,142 @@
+import {
+  getClusterConnection,
+  createDatabaseInCluster,
+  deleteDatabaseInCluster,
+  createUserInCluster,
+  deleteUserInCluster,
+  getUserInCluster,
+  getDatabaseInCluster,
+} from "../../clouds/do.js";
+
+export var IS_POSTGRES = true;
+
+function sanitize(name) {
+  return name.replace(/-/g, "_").replace(/[^a-z0-9_]/gi, "").toLowerCase();
+}
+
+function dbName(appName) {
+  return `relight_${sanitize(appName)}`;
+}
+
+function userName(appName) {
+  return `relight_${sanitize(appName)}`;
+}
+
+function buildConnectionUrl(user, password, host, port, db, sslmode) {
+  var encodedPw = encodeURIComponent(password);
+  return `postgresql://${user}:${encodedPw}@${host}:${port}/${db}?sslmode=${sslmode}`;
+}
+
+export async function createDatabase(cfg, name, opts = {}) {
+  var db = dbName(name);
+  var user = userName(name);
+
+  var conn = await getClusterConnection(cfg.apiToken, cfg.clusterId);
+
+  var dbResult = await createDatabaseInCluster(cfg.apiToken, cfg.clusterId, db);
+  var userResult = await createUserInCluster(cfg.apiToken, cfg.clusterId, user);
+
+  // Grant the app user full access to the new database's public schema.
+  // The DO API has no endpoint for schema-level grants, so we connect directly as admin.
+  await grantSchemaPrivileges(conn, db, userResult.name);
+
+  var connectionUrl = buildConnectionUrl(
+    userResult.name,
+    userResult.password,
+    conn.host,
+    conn.port,
+    dbResult.name,
+    conn.sslmode
+  );
+
+  return {
+    dbName: dbResult.name,
+    dbUser: userResult.name,
+    dbPassword: userResult.password,
+    connectionUrl,
+  };
+}
+
+async function grantSchemaPrivileges(conn, dbName, appUser) {
+  var { default: pg } = await import("pg");
+  var client = new pg.Client({
+    host: conn.host,
+    port: conn.port,
+    user: conn.user,
+    password: conn.password,
+    database: dbName,
+    ssl: conn.sslmode === "require" ? { rejectUnauthorized: false } : false,
+  });
+  await client.connect();
+  try {
+    await client.query(`GRANT ALL PRIVILEGES ON DATABASE "${dbName}" TO "${appUser}"`);
+    await client.query(`GRANT USAGE, CREATE ON SCHEMA public TO "${appUser}"`);
+    await client.query(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "${appUser}"`);
+    await client.query(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO "${appUser}"`);
+  } finally {
+    await client.end();
+  }
+}
+
+export async function destroyDatabase(cfg, name) {
+  var db = dbName(name);
+  var user = userName(name);
+
+  try { await deleteDatabaseInCluster(cfg.apiToken, cfg.clusterId, db); } catch {}
+  try { await deleteUserInCluster(cfg.apiToken, cfg.clusterId, user); } catch {}
+}
+
+export async function getDatabaseInfo(cfg, name) {
+  var db = dbName(name);
+  var user = userName(name);
+
+  var dbResult = await getDatabaseInCluster(cfg.apiToken, cfg.clusterId, db);
+  if (!dbResult) throw new Error(`Database '${db}' not found in cluster.`);
+
+  var conn = await getClusterConnection(cfg.apiToken, cfg.clusterId);
+
+  return {
+    dbName: db,
+    dbUser: user,
+    connectionUrl: `postgresql://${user}:***@${conn.host}:${conn.port}/${db}?sslmode=${conn.sslmode}`,
+  };
+}
+
+export async function listManagedDatabases(cfg) {
+  var { doApi } = await import("../../clouds/do.js");
+  var res = await doApi("GET", `/databases/${cfg.clusterId}/dbs`, undefined, cfg.apiToken);
+  var dbs = (res?.dbs || []).filter((d) => d.name.startsWith("relight_"));
+  return dbs.map((d) => ({
+    name: d.name.replace(/^relight_/, "").replace(/_/g, "-"),
+    dbName: d.name,
+  }));
+}
+
+export async function getAttachCredentials(cfg, name) {
+  var db = dbName(name);
+  var user = userName(name);
+  var conn = await getClusterConnection(cfg.apiToken, cfg.clusterId);
+
+  return {
+    connectionUrl: `postgresql://${user}:***@${conn.host}:${conn.port}/${db}?sslmode=${conn.sslmode}`,
+    isPostgres: true,
+  };
+}
+
+// Not supported: queryDatabase, importDatabase, exportDatabase, rotateToken, resetDatabase
+// These would require a direct Postgres connection via pg client — out of scope for DO logical DB.
+export async function queryDatabase() {
+  throw new Error("Direct SQL queries not supported for DigitalOcean managed databases via API. Use db shell with a Postgres client.");
+}
+export async function importDatabase() {
+  throw new Error("Database import not supported for DigitalOcean provider.");
+}
+export async function exportDatabase() {
+  throw new Error("Database export not supported for DigitalOcean provider.");
+}
+export async function rotateToken() {
+  throw new Error("Token rotation not supported for DigitalOcean provider.");
+}
+export async function resetDatabase() {
+  throw new Error("Database reset not supported for DigitalOcean provider.");
+}
diff --git a/src/lib/providers/resolve.js b/src/lib/providers/resolve.js
index 4595ec7..159c49a 100644
--- a/src/lib/providers/resolve.js
+++ b/src/lib/providers/resolve.js
@@ -12,12 +12,32 @@ export var LAYERS = ["app", "dns", "db", "registry"];
 
 var FLAG_MAP = { app: "compute", dns: "dns", db: "db", registry: "registry" };
 
+// Cache portal defaults per process to avoid repeated API calls
+var _portalDefaults = undefined;
+
+async function tryGetPortalDefaults() {
+  if (_portalDefaults !== undefined) return _portalDefaults;
+  try {
+    var { portalApi, getPortal } = await import("../portal.js");
+    if (!getPortal()) {
+      _portalDefaults = null;
+      return null;
+    }
+    var data = await portalApi("GET", "/settings/defaults");
+    _portalDefaults = data;
+    return _portalDefaults;
+  } catch {
+    _portalDefaults = null;
+    return null;
+  }
+}
+
 export async function resolveStack(options, requiredLayers) {
   if (!requiredLayers) requiredLayers = ["app"];
   var stack = {};
 
   for (var layer of requiredLayers) {
-    var name = resolveProviderName(options, layer);
+    var name = await resolveProviderName(options, layer);
     var instance = getProviderConfig(name);
     var type = instance.type;
 
@@ -40,7 +60,7 @@ export async function resolveStack(options, requiredLayers) {
   return stack;
 }
 
-function resolveProviderName(options, layer) {
+async function resolveProviderName(options, layer) {
   var flag = FLAG_MAP[layer];
 
   // 1. Explicit flag (--compute, --dns, --db, --registry)
@@ -65,6 +85,11 @@ function resolveProviderName(options, layer) {
     if (defaultName) return defaultName;
   }
 
+  // 3.5. Portal defaults (if portal configured and no local default)
+  var portalDefaults = await tryGetPortalDefaults();
+  var layerKey = { app: "compute", db: "db", registry: "registry", dns: "dns" }[layer];
+  if (portalDefaults?.[layerKey]) return portalDefaults[layerKey];
+
   // 4. Auto-resolve: only one provider supports this layer
   var candidates = getConfiguredProviders().filter((p) =>
     PROVIDERS[p.type].layers.includes(layer)
diff --git a/worker-template/package-lock.json b/worker-template/package-lock.json
new file mode 100644
index 0000000..c002e2e
--- /dev/null
+++ b/worker-template/package-lock.json
@@ -0,0 +1,21 @@
+{
+  "name": "@relight/worker-template",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@relight/worker-template",
+      "version": "0.1.0",
+      "dependencies": {
+        "@cloudflare/containers": "^0.0.30"
+      }
+    },
+    "node_modules/@cloudflare/containers": {
+      "version": "0.0.30",
+      "resolved": "https://registry.npmjs.org/@cloudflare/containers/-/containers-0.0.30.tgz",
+      "integrity": "sha512-i148xBgmyn/pje82ZIyuTr/Ae0BT/YWwa1/GTJcw6DxEjUHAzZLaBCiX446U9OeuJ2rBh/L/9FIzxX5iYNt1AQ==",
+      "license": "ISC"
+    }
+  }
+}
diff --git a/worker-template/src/index.js b/worker-template/src/index.js
index 970d327..b1b8e35 100644
--- a/worker-template/src/index.js
+++ b/worker-template/src/index.js
@@ -6,8 +6,19 @@ export class AppContainer extends Container {
   constructor(ctx, env) {
     super(ctx, env);
     var appConfig = JSON.parse(env.RELIGHT_APP_CONFIG);
-    this.defaultPort = appConfig.port || 8080;
+    var port = appConfig.port || 8080;
+
+    // Set port properties together — requiredPorts must match defaultPort so that
+    // the startup health-check pings the correct port.
+    this.defaultPort = port;
+    this.requiredPorts = [port];
+
     this.sleepAfter = appConfig.sleepAfter || "30s";
+    // The base Container constructor calls renewActivityTimeout() synchronously
+    // (inside blockConcurrencyWhile) before this constructor body runs, so
+    // sleepAfterMs was calculated with the DEFAULT value. Re-call here so the
+    // idle timer reflects the app's actual sleepAfter from the very first alarm.
+    this.renewActivityTimeout();
 
     // Read env vars from native bindings (new format)
     var envVars = {};
@@ -23,14 +34,98 @@ export class AppContainer extends Container {
         if (envVars[key] === undefined) envVars[key] = appConfig.env[key];
       }
     }
+    // NOTE: Hyperdrive connection strings (*.hyperdrive.local) are only resolvable
+    // inside the Workers runtime — containers run as Firecracker VMs with no access
+    // to that DNS. The container must receive the original DATABASE_URL so it can
+    // connect directly to PostgreSQL. Hyperdrive is not used for container workloads.
     this.envVars = envVars;
   }
+
+  // Extended startup options: CF Firecracker cold start can take up to 30s
+  // depending on image size and region provisioning — the base class default
+  // (8s instance get + 20s port ready) is not enough in those cases.
+  get _startOpts() {
+    return {
+      cancellationOptions: {
+        instanceGetTimeoutMS: 30_000,
+        portReadyTimeoutMS: 120_000,
+        waitInterval: 300,
+      },
+    };
+  }
+
+  async fetch(request) {
+    // Clone upfront so we can retry with the original body if needed.
+    var cloned = request.clone();
+
+    var state = await this.getState();
+    if (!this.container.running || state.status !== "healthy") {
+      var err = await this._wake();
+      if (err) return err;
+    }
+
+    var response = await this.containerFetch(request, this.defaultPort);
+
+    // Race condition: sleepAfter timer fired between the state check above and
+    // the actual proxy call. Retry once after waking the container.
+    if (response.status === 500 && !this.container.running) {
+      console.log("[AppContainer] container slept mid-request, retrying");
+      await new Promise(resolve => setTimeout(resolve, 500));
+      var err2 = await this._wake();
+      if (err2) return err2;
+      return this.containerFetch(cloned, this.defaultPort);
+    }
+
+    return response;
+  }
+
+  async _wake() {
+    try {
+      await this.startAndWaitForPorts(this._startOpts);
+      return null;
+    } catch (e) {
+      var msg = e instanceof Error ? e.message : String(e);
+      console.error("[AppContainer] wake failed:", msg);
+      if (msg.includes("no container instance") || msg.includes("Maximum number")) {
+        return new Response("Container is starting up — please retry in a moment.", {
+          status: 503,
+          headers: { "Retry-After": "10" },
+        });
+      }
+      return new Response("Failed to start container: " + msg, { status: 500 });
+    }
+  }
+
+  onStart() {
+    console.log("[AppContainer] started port=" + this.defaultPort + " sleep=" + this.sleepAfter);
+  }
+
+  onStop(payload) {
+    var reason = payload?.reason || "unknown";
+    var exitCode = payload?.exitCode != null ? " exit=" + payload.exitCode : "";
+    console.log("[AppContainer] stopped reason=" + reason + exitCode);
+  }
+
+  onError(error) {
+    console.error("[AppContainer] error:", error instanceof Error ? error.message : String(error));
+    // Returning normally (not throwing) lets the base class mark the container
+    // as stopped. CF restarts it transparently on the next request via fetch().
+  }
 }
 
 export default {
   async fetch(request, env) {
     var appConfig = JSON.parse(env.RELIGHT_APP_CONFIG);
 
+    // Gateway secret: when set, reject requests without the correct header.
+    // This makes the worker unreachable directly even though it has a workers.dev URL.
+    if (env.GATEWAY_SECRET) {
+      var gatewayHeader = request.headers.get("x-gateway-secret");
+      if (gatewayHeader !== env.GATEWAY_SECRET) {
+        return new Response("Forbidden", { status: 403 });
+      }
+    }
+
     // Hrana protocol handler - only active when D1 binding exists
     if (env.DB) {
       var url = new URL(request.url);