@geekmidas/cli 10.0.0-alpha.87 → 10.0.0-alpha.89

package/dist/{seeds-BYdrtZsC.mjs → seeds-perzdN81.mjs}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { r as storedCredentials, s as run$1, v as gkmHome } from "./credentials-BgJ5mS_d.mjs";
+import { r as storedCredentials, s as run$1, x as gkmHome } from "./credentials-CnVqoXMb.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { B as provisioningOf, G as BucketKeySetElsewhere, H as S3_PROVISIONING, I as stageSampleRate, J as IamUserNotOwned, K as BucketNameUnavailable, L as telemetryEnv, Q as S3RegionRequired, R as LOGS_PORT, U as checkS3Config, V as stageProvider, W as AccessKeyLimit, X as RecordedBucketUnreachable, Y as ProvisionedBucketUnreachable, Z as RotationInProgress, g as getPublicEnvPrefix, h as PUBLIC_ENV_PREFIXES, k as TEST_STAGE, q as BucketOwnedByAnotherProject, r as allConstructGlobs, rt as UnknownSecretsStoreProvider } from "./workspace-D2CYLMCW.mjs";
+import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-CJ0lKFq-.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
-import { c as runtimeOf } from "./resolve-BSke45k6.mjs";
+import { c as runtimeOf } from "./resolve-Dv_weZoh.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -29,6 +29,7 @@ import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-s
 import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
+import { lookup } from "node:dns/promises";
 import * as s3Url from "@geekmidas/storage/s3-url";
 //#region src/workspace/rootSite.ts
 /**
@@ -74,11 +75,11 @@ var AmbiguousRootSite = class extends Error {
 };
 //#endregion
 //#region src/target/dokploy/domain.ts
-/** A stage was deployed that `deploy.domains` gives no domain. */
+/** A stage was deployed that `domains` gives no domain. */
 var NoDomainForStage = class extends Error {
 	stage;
 	constructor(stage) {
-		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: domains: { ${stage}: 'example.com' }.`);
 		this.stage = stage;
 		this.name = "NoDomainForStage";
 	}
@@ -87,11 +88,11 @@ var NoDomainForStage = class extends Error {
 * The hostname an app answers on for a stage.
 *
 * 1. An explicit `app.domain` — a string, or one per stage — wins.
-* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+* 2. Otherwise from the stage's base domain in `domains`: the root site
 *    answers on the domain itself, and every other app on
 *    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
 *
-* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
+* @throws {NoDomainForStage} when `domains` names no domain for it
 */
 function resolveHost(appName, app, stage, domains, isMainFrontend) {
 	if (app.domain) {
@@ -300,6 +301,11 @@ function logsAccess(logs, ctx) {
 }
 //#endregion
 //#region src/secrets/storage.ts
+/**
+* What a stage's secrets are, independent of where they are kept: building
+* them, changing them, and handing them to a process. Where they are kept is a
+* {@link SecretsStore}'s business — see `secretsStoreFor`.
+*/
 var storage_exports = /* @__PURE__ */ __exportAll({
 	initStageSecrets: () => initStageSecrets,
 	maskPassword: () => maskPassword,
@@ -328,7 +334,7 @@ function initStageSecrets(stage) {
 function toEmbeddableSecrets(secrets) {
 	return {
 		...secrets.urls,
-		...secrets.custom,
+		...Object.fromEntries(Object.entries(secrets.custom).filter(([key]) => !isReservedStageKey(key))),
 		...secrets.services.postgres && {
 			POSTGRES_USER: secrets.services.postgres.username,
 			POSTGRES_PASSWORD: secrets.services.postgres.password,
@@ -854,7 +860,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$1 = console;
+const logger$2 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -905,7 +911,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -942,7 +948,7 @@ async function savePortState(workspaceRoot, ports) {
 async function loadSecretsForApp(store, stage) {
 	const stageSecrets = await store.read(stage);
 	if (!stageSecrets) return {};
-	logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+	logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
 	return toEmbeddableSecrets(stageSecrets);
 }
 /**
@@ -1040,7 +1046,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -1064,7 +1070,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = join(secretsRoot, ".gkm");
 	await mkdir(secretsDir, { recursive: true });
@@ -6771,6 +6777,14 @@ function requiredStageKeys(input) {
 			...apps(d)
 		});
 	}
+	if (!input.local && input.server) add({
+		key: SERVER_IPV4_KEY,
+		id: "server",
+		kind: "server",
+		what: "the public IPv4 address of the server the stage's stack runs on — its hosts' DNS records point at it, and every deploy checks they do",
+		note: `${SERVER_IPV6_KEY} adds its IPv6 address (AAAA records); neither is ever handed to an app`,
+		example: "203.0.113.10"
+	});
 	for (const d of byId(input.credentials)) add({
 		key: provideKey(d.id, "credentials"),
 		id: d.id,
@@ -7201,17 +7215,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-Q4vXg2ua.mjs").then((n) => n.n);
+		const { LocalStateStore } = await import("./LocalStateStore-C_hYDv6I.mjs").then((n) => n.n);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-B0R4LlX_.mjs");
+		const { LegacyStateStore } = await import("./LegacyStateStore-CO7bzJCU.mjs");
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-BszSCAS2.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-IvcjTk8h.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7221,7 +7235,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-CksKYKRa.mjs");
+		const { S3StateStore } = await import("./S3StateStore-hIm8Rrmu.mjs");
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7234,6 +7248,570 @@ async function createStateStore(options) {
 	throw new UnknownStateProvider(config);
 }
 //#endregion
+//#region src/target/dokploy/dns/DnsProvider.ts
+/**
+* Check if value is a DnsProvider implementation.
+*/
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+}
+/**
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'godaddy': GoDaddyProvider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
+*/
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await import("./HostingerProvider-BI6J7oJr.mjs");
+		return new HostingerProvider();
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await import("./Route53Provider-QXxjkZO1.mjs");
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
+		});
+	}
+	if (provider === "godaddy") {
+		const { GoDaddyProvider } = await import("./GoDaddyProvider--36rw8cP.mjs");
+		return new GoDaddyProvider(options.godaddy ?? {});
+	}
+	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
+	throw new DnsProviderUnknown(config);
+}
+/**
+* The provider's credentials can write records and not read them — a key
+* scoped to updates only. What reads them falls back to writing every record,
+* which is idempotent, without a diff.
+*/
+var DnsRecordsUnreadable = class extends Error {
+	provider;
+	domain;
+	reason;
+	constructor(provider, domain, reason) {
+		super(`The ${provider} key cannot read ${domain}'s DNS records (${reason}), so changes cannot be compared with what is there: every record is written, which leaves one that already has its value as it was.`);
+		this.provider = provider;
+		this.domain = domain;
+		this.reason = reason;
+		this.name = "DnsRecordsUnreadable";
+	}
+};
+/** A DNS provider gkm names and does not have yet. */
+var DnsProviderNotImplemented = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The ${provider} DNS provider is not implemented yet. Use 'route53', 'godaddy', 'hostinger' or 'manual' for this domain in dns, or pass your own DnsProvider object.`);
+		this.provider = provider;
+		this.name = "DnsProviderNotImplemented";
+	}
+};
+/** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
+var DnsProviderUnknown = class extends Error {
+	config;
+	constructor(config) {
+		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
+		this.config = config;
+		this.name = "DnsProviderUnknown";
+	}
+};
+//#endregion
+//#region src/deploy/state.ts
+/**
+* Create a new empty state for a stage
+*/
+function createEmptyState(stage, projectId, environmentId) {
+	return {
+		provider: "dokploy",
+		stage,
+		projectId,
+		environmentId,
+		applications: {},
+		services: {},
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Set application ID in state (mutates state)
+*/
+function setApplicationId(state, appName, applicationId) {
+	state.applications[appName] = applicationId;
+}
+/** Two records naming the same image: by digest when both have one. */
+function sameImage(a, b) {
+	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
+}
+/** The newest release in `history` after `index` that a rollback may restore. */
+function restorable(history, index, current) {
+	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
+}
+/**
+* Record that `image` went live for `appName` (mutates state): it becomes
+* `current`, and what was current becomes `previous`. Releasing what already
+* runs — a redeploy of the same digest — changes nothing.
+*/
+function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+	const releases = state.releases?.[appName];
+	if (releases && sameImage(releases.current, image)) return;
+	const entry = {
+		...image,
+		releasedAt: releasedAt.toISOString()
+	};
+	const history = [entry, ...releases?.history ?? []].slice(0, 10);
+	const previous = releases?.current;
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current: entry,
+			...previous ? { previous } : {},
+			history
+		}
+	};
+}
+/**
+* Record that `appName` was rolled back to `to` (mutates state): every
+* release newer than it is marked rolled back, so neither this rollback nor
+* a later one restores it, and `previous` moves to the release before `to`.
+*/
+function recordRollback(state, appName, to) {
+	const releases = state.releases?.[appName];
+	if (!releases) return;
+	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
+	if (index === -1) return;
+	const history = releases.history.map((entry, i) => i < index ? {
+		...entry,
+		rolledBack: true
+	} : entry);
+	const current = history[index];
+	const previous = restorable(history, index, current);
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current,
+			...previous ? { previous } : {},
+			history
+		}
+	};
+}
+/**
+* Get a generated secret for an app
+*/
+function getGeneratedSecret(state, appName, secretName) {
+	return state?.generatedSecrets?.[appName]?.[secretName];
+}
+/**
+* Set a generated secret for an app (mutates state)
+*/
+function setGeneratedSecret(state, appName, secretName, value) {
+	if (!state.generatedSecrets) state.generatedSecrets = {};
+	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
+	state.generatedSecrets[appName][secretName] = value;
+}
+/**
+* Set DNS verification record for a hostname (mutates state)
+*/
+function setDnsVerification(state, hostname, serverIp) {
+	if (!state.dnsVerified) state.dnsVerified = {};
+	state.dnsVerified[hostname] = {
+		serverIp,
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Check if a hostname is already verified with the given IP
+*/
+function isDnsVerified(state, hostname, serverIp) {
+	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
+}
+/**
+* Get the key for a DNS record in state
+*/
+function getDnsRecordKey(name, type) {
+	return `${name}:${type}`;
+}
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Get backup state from state
+*/
+function getBackupState(state) {
+	return state?.backups;
+}
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
+}
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
+}
+//#endregion
+//#region src/target/dokploy/dns/index.ts
+/**
+* DNS orchestration for deployments
+*
+* Handles automatic DNS record creation for deployed applications.
+*/
+const logger$1 = output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
+}
+/**
+* Normalize DNS config to new multi-domain format
+*/
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
+	}
+	return config;
+}
+/**
+* Find the root domain for a hostname from available DNS configs
+*
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
+*/
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
+}
+/**
+* Group hostnames by their root domain
+*/
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$1.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
+	}
+	return grouped;
+}
+/**
+* Resolve IP address from a hostname
+*/
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await lookup(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
+*/
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
+}
+/**
+* Generate required DNS records for a deployment
+*/
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
+}
+/**
+* Print DNS records table
+*/
+function printDnsRecordsTable(records, rootDomain) {
+	logger$1.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$1.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$1.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$1.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$1.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+	}
+	logger$1.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+}
+/**
+* Print DNS records in a simple format for manual setup
+*/
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$1.log("\n   📋 Required DNS Records:");
+	logger$1.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$1.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$1.log("");
+}
+/**
+* Create DNS records for a single domain using its configured provider
+*/
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
+	}
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
+	try {
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
+	}
+	return results;
+}
+/**
+* Main DNS orchestration function for deployments
+*
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+*
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
+*/
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$1.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$1.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
+	}
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$1.log("   No DNS records needed (no hostnames match configured domains)");
+		return {
+			records: [],
+			success: true,
+			serverIp
+		};
+	}
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$1.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
+		}
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$1.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$1.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$1.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$1.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+	}
+	return {
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
+	};
+}
+/**
+* Verify DNS records resolve correctly after deployment.
+*
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
+*/
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$1.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (isDnsVerified(state, hostname, serverIp)) {
+			logger$1.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				setDnsVerification(state, hostname, serverIp);
+				logger$1.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$1.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$1.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
+			});
+		}
+	}
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$1.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$1.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$1.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
+}
+//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -7717,149 +8295,6 @@ var DeployJournal = class DeployJournal {
 	}
 };
 //#endregion
-//#region src/deploy/state.ts
-/**
-* Create a new empty state for a stage
-*/
-function createEmptyState(stage, projectId, environmentId) {
-	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/** Two records naming the same image: by digest when both have one. */
-function sameImage(a, b) {
-	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
-}
-/** The newest release in `history` after `index` that a rollback may restore. */
-function restorable(history, index, current) {
-	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
-}
-/**
-* Record that `image` went live for `appName` (mutates state): it becomes
-* `current`, and what was current becomes `previous`. Releasing what already
-* runs — a redeploy of the same digest — changes nothing.
-*/
-function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
-	const releases = state.releases?.[appName];
-	if (releases && sameImage(releases.current, image)) return;
-	const entry = {
-		...image,
-		releasedAt: releasedAt.toISOString()
-	};
-	const history = [entry, ...releases?.history ?? []].slice(0, 10);
-	const previous = releases?.current;
-	state.releases = {
-		...state.releases,
-		[appName]: {
-			current: entry,
-			...previous ? { previous } : {},
-			history
-		}
-	};
-}
-/**
-* Record that `appName` was rolled back to `to` (mutates state): every
-* release newer than it is marked rolled back, so neither this rollback nor
-* a later one restores it, and `previous` moves to the release before `to`.
-*/
-function recordRollback(state, appName, to) {
-	const releases = state.releases?.[appName];
-	if (!releases) return;
-	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
-	if (index === -1) return;
-	const history = releases.history.map((entry, i) => i < index ? {
-		...entry,
-		rolledBack: true
-	} : entry);
-	const current = history[index];
-	const previous = restorable(history, index, current);
-	state.releases = {
-		...state.releases,
-		[appName]: {
-			current,
-			...previous ? { previous } : {},
-			history
-		}
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
-*/
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
-}
-/**
-* Set a created DNS record in state (mutates state)
-*/
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Get backup state from state
-*/
-function getBackupState(state) {
-	return state?.backups;
-}
-/**
-* Set backup state (mutates state)
-*/
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
-}
-//#endregion
 //#region src/providers/aws.ts
 /**
 * The AWS account a provider provisions in — the stage's, found the way the
@@ -8055,7 +8490,7 @@ function bucketOrigins(input) {
 			continue;
 		}
 		try {
-			const host = resolveHost(name, app, stage, workspace.deploy?.domains, isMainFrontendApp(name, app, workspace.apps));
+			const host = resolveHost(name, app, stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
 			origins.add(`https://${host}`);
 		} catch (error) {
 			if (!(error instanceof NoDomainForStage)) throw error;
@@ -8497,7 +8932,7 @@ async function ensureBucketSettings(ctx, clients, input) {
 		stage: ctx.stage,
 		bucket: id
 	});
-	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (deploy.domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
+	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
 	if (origins.length === 0) return;
 	const rule = corsRule(origins);
 	const cors = await read(() => s3.send(new S3.GetBucketCorsCommand({ Bucket })), ["NoSuchCORSConfiguration"]);
@@ -9046,6 +9481,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { suppliedOnly as $, stackLogs as $n, storageBackendFor as $t, workerDockerfileOf as A, store_exports as An, postgresStatements as At, newLockHolder as B, isOwnedBy as Bn, envFor as Bt, stageProviderNotes as C, loadEnvFiles as Cn, LOCAL_CA_PATH as Ct, dockerCommand as D, isRemoteStore as Dn, applyPostgres as Dt, appDockerfile as E, prepareEntryCredentials as En, applyPolicies as Et, StateStoreBusy as F, readKey as Fn, pgClient as Ft, STORAGE_KEY_PAIR as G, maskPassword as Gn, WORKER_PORT as Gt, DEV_SERVICES as H, ownershipMarker as Hn, composeBuildPaths as Ht, StateStoreWithoutLocking as I, applicationName as In, appEnvKeys as It, devServicesUsed as J, withCustomSecret as Jn, imageBuildCredentials as Jt, assertDevServicesFlag as K, storage_exports as Kn, detectPackageManager as Kt, StateVersionConflict as L, deployIdentity as Ln, dockerfileOf as Lt, DocumentStateStore as M, getKeyPath as Mn, LEGACY_LOCAL_LOGIN as Mt, StageStateMissing as N, keystoreProject as Nn, ensurePostgresLogin as Nt, ensureDockerignore as O, secretsStoreFor as On, bucketPolicies as Ot, StateLocked as P, projectKey as Pn, bucketClient as Pt, requiredStageKeys as Q, logsService as Qn, providerOf as Qt, contentVersion as R, imageName as Rn, networkEnv as Rt, provisionCommand as S, isPortAvailable as Sn, withRedisPassword as St, DockerPushFailed as T, loadSecretsForApp as Tn, applyBuckets as Tt, DevServicesNeedServerTarget as U, projectName as Un, imageLayout as Ut, AllowDevServicesTakesNoValue as V, markerOf as Vn, localRolePassword as Vt, ExternalServicesNotConfigured as W, initStageSecrets as Wn, TURBO_VERSION as Wt, manifestServiceDeclarations as X, LOGS_SERVICE as Xn, cacheBackendFor as Xt, externalServices as Y, LOCAL_LOGS_EMAIL as Yn, isImageBuild as Yt, reportDevServices as Z, logsAccess as Zn, eventsBackendFor as Zt, setGeneratedSecret as _, portsOf as _n, REDIS_SERVICE as _t, provisionStage as a, resourceName as an, CronGenerator as at, StageProviderDisabled as b, createEntryWrapper as bn, runsRedis as bt, getBackupState as c, isTelemetryKey as cn, constructGlobs as ct, recordRelease as d, telemetryOf as dn, workspace_exports as dt, CLUSTER_DATABASE as en, withLogsPassword as er, workerUnits as et, recordRollback as f, usesTelemetry as fn, LOCAL_RABBITMQ_USER as ft, setDnsVerification as g, portKeys as gn, withGeneratedSecrets as gt, setDnsRecord as h, fakeKey as hn, readLocalCredentials as ht, assertNoStaleSecrets as i, planFor as in, QueueGenerator as it, validateImageRef as j, FileSecretsStore as jn, quoteIdentifier as jt, workerDockerfile as k, storeFromConfig as kn, postgresDatabaseNames as kt, getGeneratedSecret as l, scopeTelemetryEnv as ln, derivedContainers as lt, setBackupState as m, describeServices as mn, postgresSuperuser as mt, reportDatabaseRuns as n, EMULATOR_ACCESS_KEY_ID as nn, isMainFrontendApp as nr, workerBundleName as nt, verifyStageProviders as o, hostFor as on, FAKE_ENV as ot, setApplicationId as p, DEFAULT_IMAGES as pn, loadLocalCredentials as pt, assertExternalServices as q, toEmbeddableSecrets as qn, findBuildRoot as qt, reportPlannedSeeds as r, TELEMETRY_CONTAINER as rn, resolveHost as rr, workerEntryDir as rt, createEmptyState as s, appTelemetry as sn, backendsOf as st, DeploySeedsFailed as t, composeFor as tn, NoDomainForStage as tr, WorkerGenerator as tt, isDnsVerified as u, surfaceClientTraced as un, reconcileWorkspace as ut, setPostgresBackupId as v, primaryPortKey as vn, STACK_CACHE as vt, DockerBuildFailed as w, loadPortState as wn, forgetState as wt, assertStageProvidersEnabled as x, findAvailablePort as xn, stackRedis as xt, DeployJournal as y, createCredentialsPreload as yn, redisService as yt, createStateStore as z, imageRef as zn, workerEnvKeys as zt };
+export { externalServices as $, LOCAL_LOGS_EMAIL as $n, isImageBuild as $t, setApplicationId as A, prepareEntryCredentials as An, applyPolicies as At, StateStoreWithoutLocking as B, applicationName as Bn, appEnvKeys as Bt, orchestrateDns as C, createCredentialsPreload as Cn, redisService as Ct, getGeneratedSecret as D, loadEnvFiles as Dn, LOCAL_CA_PATH as Dt, getBackupState as E, isPortAvailable as En, withRedisPassword as Et, createDnsProvider as F, FileSecretsStore as Fn, quoteIdentifier as Ft, AllowDevServicesTakesNoValue as G, markerOf as Gn, localRolePassword as Gt, contentVersion as H, imageName as Hn, networkEnv as Ht, DocumentStateStore as I, getKeyPath as In, LEGACY_LOCAL_LOGIN as It, ExternalServicesNotConfigured as J, initStageSecrets as Jn, TURBO_VERSION as Jt, DEV_SERVICES as K, ownershipMarker as Kn, composeBuildPaths as Kt, StageStateMissing as L, keystoreProject as Ln, ensurePostgresLogin as Lt, setGeneratedSecret as M, secretsStoreFor as Mn, bucketPolicies as Mt, setPostgresBackupId as N, storeFromConfig as Nn, postgresDatabaseNames as Nt, recordRelease as O, loadPortState as On, forgetState as Ot, DnsRecordsUnreadable as P, store_exports as Pn, postgresStatements as Pt, devServicesUsed as Q, withCustomSecret as Qn, imageBuildCredentials as Qt, StateLocked as R, projectKey as Rn, bucketClient as Rt, normalizeDnsConfig as S, primaryPortKey as Sn, STACK_CACHE as St, createEmptyState as T, findAvailablePort as Tn, stackRedis as Tt, createStateStore as U, imageRef as Un, workerEnvKeys as Ut, StateVersionConflict as V, deployIdentity as Vn, dockerfileOf as Vt, newLockHolder as W, isOwnedBy as Wn, envFor as Wt, assertDevServicesFlag as X, storage_exports as Xn, detectPackageManager as Xt, STORAGE_KEY_PAIR as Y, maskPassword as Yn, WORKER_PORT as Yt, assertExternalServices as Z, toEmbeddableSecrets as Zn, findBuildRoot as Zt, workerDockerfile as _, DEFAULT_IMAGES as _n, loadLocalCredentials as _t, provisionStage as a, composeFor as an, NoDomainForStage as ar, WorkerGenerator as at, extractSubdomain as b, portKeys as bn, withGeneratedSecrets as bt, StageProviderDisabled as c, planFor as cn, QueueGenerator as ct, stageProviderNotes as d, appTelemetry as dn, backendsOf as dt, cacheBackendFor as en, LOGS_SERVICE as er, manifestServiceDeclarations as et, DockerBuildFailed as f, isTelemetryKey as fn, constructGlobs as ft, ensureDockerignore as g, usesTelemetry as gn, LOCAL_RABBITMQ_USER as gt, dockerCommand as h, telemetryOf as hn, workspace_exports as ht, assertNoStaleSecrets as i, CLUSTER_DATABASE as in, withLogsPassword as ir, workerUnits as it, setBackupState as j, isRemoteStore as jn, applyPostgres as jt, recordRollback as k, loadSecretsForApp as kn, applyBuckets as kt, assertStageProvidersEnabled as l, resourceName as ln, CronGenerator as lt, appDockerfile as m, surfaceClientTraced as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, providerOf as nn, logsService as nr, requiredStageKeys as nt, verifyStageProviders as o, EMULATOR_ACCESS_KEY_ID as on, isMainFrontendApp as or, workerBundleName as ot, DockerPushFailed as p, scopeTelemetryEnv as pn, derivedContainers as pt, DevServicesNeedServerTarget as q, projectName as qn, imageLayout as qt, reportPlannedSeeds as r, storageBackendFor as rn, stackLogs as rr, suppliedOnly as rt, DeployJournal as s, TELEMETRY_CONTAINER as sn, resolveHost as sr, workerEntryDir as st, DeploySeedsFailed as t, eventsBackendFor as tn, logsAccess as tr, reportDevServices as tt, provisionCommand as u, hostFor as un, FAKE_ENV as ut, workerDockerfileOf as v, describeServices as vn, postgresSuperuser as vt, verifyDnsRecords as w, createEntryWrapper as wn, runsRedis as wt, findRootDomain as x, portsOf as xn, REDIS_SERVICE as xt, validateImageRef as y, fakeKey as yn, readLocalCredentials as yt, StateStoreBusy as z, readKey as zn, pgClient as zt };
 
-//# sourceMappingURL=seeds-BYdrtZsC.mjs.map
+//# sourceMappingURL=seeds-perzdN81.mjs.map