@geekmidas/cli 10.0.0-alpha.87 → 10.0.0-alpha.89

package/dist/{compose-xw86kVYi.cjs → compose-BvrhDwJ6.cjs}

@@ -1,10 +1,10 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-tr26-KML.cjs");
+const require_credentials = require("./credentials-BKfIugu2.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CT0JM3Y8.cjs");
+const require_workspace = require("./workspace-CwW3Gkru.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_seeds = require("./seeds-CsI0A_Ef.cjs");
+const require_seeds = require("./seeds-CN6tB-va.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
 const require_drivers = require("./drivers-LYSdQDmd.cjs");
 const require_databases = require("./databases-BY-pEImp.cjs");
@@ -14,10 +14,428 @@ let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_net = require("node:net");
 let node_child_process = require("node:child_process");
 let node_crypto = require("node:crypto");
 let yaml = require("yaml");
+let node_dns_promises = require("node:dns/promises");
 let node_https = require("node:https");
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${require_workspace.SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends Error {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === require_workspace.SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends Error {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${require_workspace.SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${require_workspace.SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[require_workspace.SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[require_workspace.SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !(0, node_net.isIPv6)(ipv6)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!(0, node_net.isIPv4)(ipv4)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? require_seeds.normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = require_seeds.extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = require_seeds.findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = require_workspace.cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => require_seeds.createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof require_seeds.DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${require_workspace.SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await (0, node_dns_promises.lookup)(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends Error {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
 //#region src/compose/docker.ts
 /**
 * The Docker operations `gkm compose` needs, behind an interface.
@@ -794,6 +1212,36 @@ function pinImages(file, digests, images) {
 	});
 }
 //#endregion
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = require_seeds.withGeneratedSecrets(stored ?? require_seeds.initStageSecrets(stage), manifest);
+	const withLogs = require_workspace.resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: require_seeds.usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? require_seeds.withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = require_seeds.runsRedis(manifest, withLogs.secrets.custom ?? {}) ? require_seeds.withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /**
 * The stack's own edge, rendered for Caddy: one site block per route.
@@ -878,6 +1326,21 @@ const HEADER = `# Generated by gkm compose from the construct manifest — do no
 * address and once on the compose network, because a browser and a sibling
 * service reach the same API by different names.
 */
+var stack_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	EDGE_PORT_ENV: () => EDGE_PORT_ENV,
+	EnvValueMultiline: () => EnvValueMultiline,
+	LOGS_PORT_ENV: () => LOGS_PORT_ENV,
+	LOG_ROTATION: () => LOG_ROTATION,
+	LocalCredentialsMissing: () => LocalCredentialsMissing,
+	NothingToCompose: () => NothingToCompose,
+	StageSecretMissing: () => StageSecretMissing,
+	StageSeedMissing: () => StageSeedMissing,
+	composeProject: () => composeProject,
+	composeStack: () => composeStack,
+	derivedCredentials: () => derivedCredentials,
+	envFile: () => envFile,
+	stackDir: () => stackDir
+});
 /** Where a stack's files are written, relative to the workspace root. */
 function stackDir(stage) {
 	return `.gkm/compose/${stage}`;
@@ -1111,7 +1574,7 @@ function composeStack(input) {
 		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_seeds.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
 	for (const worker of workers) reads.set(worker.name, [...require_seeds.workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
-	const domain = workspace.deploy?.domains?.[stage];
+	const domain = workspace.domains?.[stage];
 	const telemetry = require_workspace.resolveStageTelemetry({
 		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
 		stage,
@@ -1226,6 +1689,7 @@ function composeStack(input) {
 	* they can hold it, and the derivations otherwise.
 	*/
 	const valueFor = (app, key, owner) => {
+		if (require_workspace.isReservedStageKey(key)) return void 0;
 		if (owner && SERVICE_KINDS[owner.kind]) {
 			if (custom[key] !== void 0) return custom[key];
 			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
@@ -1509,7 +1973,7 @@ function stackWorkers(units, options) {
 */
 function hostOf(name, app, workspace, resource, options) {
 	if (options.local) return require_seeds.hostFor(resource, workspace.name);
-	return require_seeds.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_seeds.isMainFrontendApp(name, app, workspace.apps));
+	return require_seeds.resolveHost(name, app, options.stage, workspace.domains, require_seeds.isMainFrontendApp(name, app, workspace.apps));
 }
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
@@ -1840,7 +2304,8 @@ const defaultDeps = {
 	probe: httpsProbe,
 	healthAttempts: 90,
 	healthIntervalMs: 2e3,
-	env: process.env
+	env: process.env,
+	lookup: systemLookup
 };
 /**
 * The stack the stage would run, and — for a tag — the registry's word that
@@ -1865,6 +2330,7 @@ async function validateCompose(ctx, deps, options = {}) {
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const server = push || stage === workspace.stages.local ? void 0 : requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
 	if (!push) {
 		require_seeds.assertNoStaleSecrets({
 			manifest,
@@ -1915,6 +2381,7 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (stack.tls && !push) {
 		for (const file of [stack.tls.certFile, stack.tls.keyFile]) if (!(0, node_fs.existsSync)(file)) throw new require_workspace.ComposeTlsFileMissing(stage, file);
 	}
+	if (!push && !stack.local) await checkDns(ctx, deps, stackHosts(stack).filter((host) => !isLocalHost(host)), server);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
@@ -1982,35 +2449,46 @@ function assertRedisClient(workspace, stack) {
 * run goes ahead (`provision`), so a dry run, or a tag that is not there,
 * leaves the stage's secrets as it found them.
 */
+/**
+* The deploy-time DNS check: each public host resolved with the system
+* resolver and compared with the server's address from the stage's secrets.
+* A dry run warns rather than stops.
+*/
+async function checkDns(ctx, deps, hosts, server) {
+	const { workspace, stage } = ctx;
+	if (hosts.length === 0) return;
+	if (ctx.skipDnsCheck) {
+		ctx.logger.info("🌐 DNS check skipped (--skip-dns-check)");
+		return;
+	}
+	if (!server) {
+		ctx.logger.info(`🌐 DNS check skipped: no ${require_workspace.SERVER_IPV4_KEY} in '${stage}''s secrets — ${serverAddressHint(stage)}`);
+		return;
+	}
+	try {
+		const ok = await checkStackDns({
+			stage,
+			hosts,
+			server,
+			dns: workspace.dns,
+			lookup: deps.lookup ?? systemLookup
+		});
+		ctx.logger.info(`🌐 ${ok.length} host${ok.length === 1 ? "" : "s"} resolve${ok.length === 1 ? "s" : ""} to ${server.ipv4}`);
+	} catch (error) {
+		if (ctx.dryRun && error instanceof HostNotPointingAtServer) {
+			ctx.logger.warn(`⚠ ${error.message}`);
+			return;
+		}
+		throw error;
+	}
+}
 async function stageSecrets(ctx, manifest) {
 	const stored = await ctx.secrets.read();
 	if (ctx.stage === ctx.workspace.stages.local) return {
 		secrets: stored,
 		generated: []
 	};
-	const withSeed = require_seeds.withGeneratedSecrets(stored ?? require_seeds.initStageSecrets(ctx.stage), manifest);
-	const withLogs = require_workspace.resolveStageTelemetry({
-		...ctx.workspace.deploy?.telemetry ? { telemetry: ctx.workspace.deploy.telemetry } : {},
-		stage: ctx.stage,
-		local: false,
-		target: "compose",
-		runtime: "server",
-		selfHosted: true,
-		used: require_seeds.usesTelemetry(manifest)
-	})?.provider === "self-hosted" ? require_seeds.withLogsPassword(withSeed.secrets) : {
-		secrets: withSeed.secrets,
-		generated: []
-	};
-	const withRedis = require_seeds.runsRedis(manifest, withLogs.secrets.custom ?? {}) ? require_seeds.withRedisPassword(withLogs.secrets) : {
-		secrets: withLogs.secrets,
-		generated: []
-	};
-	const secrets = withRedis.secrets;
-	const generated = [
-		...withSeed.generated,
-		...withLogs.generated,
-		...withRedis.generated
-	];
+	const { secrets, generated } = deployedStackSecrets(ctx.workspace, ctx.stage, stored, manifest);
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -2675,6 +3153,12 @@ Object.defineProperty(exports, "EDGE_PROJECT", {
 		return EDGE_PROJECT;
 	}
 });
+Object.defineProperty(exports, "applyStackDns", {
+	enumerable: true,
+	get: function() {
+		return applyStackDns;
+	}
+});
 Object.defineProperty(exports, "composeProject", {
 	enumerable: true,
 	get: function() {
@@ -2717,23 +3201,65 @@ Object.defineProperty(exports, "pinnedRef", {
 		return pinnedRef;
 	}
 });
+Object.defineProperty(exports, "planStackDns", {
+	enumerable: true,
+	get: function() {
+		return planStackDns;
+	}
+});
 Object.defineProperty(exports, "removeEdgeRoutes", {
 	enumerable: true,
 	get: function() {
 		return removeEdgeRoutes;
 	}
 });
+Object.defineProperty(exports, "requiredServerAddress", {
+	enumerable: true,
+	get: function() {
+		return requiredServerAddress;
+	}
+});
+Object.defineProperty(exports, "secrets_exports", {
+	enumerable: true,
+	get: function() {
+		return secrets_exports;
+	}
+});
+Object.defineProperty(exports, "serverAddress", {
+	enumerable: true,
+	get: function() {
+		return serverAddress;
+	}
+});
+Object.defineProperty(exports, "serverAddressHint", {
+	enumerable: true,
+	get: function() {
+		return serverAddressHint;
+	}
+});
 Object.defineProperty(exports, "stackDir", {
 	enumerable: true,
 	get: function() {
 		return stackDir;
 	}
 });
+Object.defineProperty(exports, "stackHosts", {
+	enumerable: true,
+	get: function() {
+		return stackHosts;
+	}
+});
 Object.defineProperty(exports, "stackOverrideFile", {
 	enumerable: true,
 	get: function() {
 		return stackOverrideFile;
 	}
 });
+Object.defineProperty(exports, "stack_exports", {
+	enumerable: true,
+	get: function() {
+		return stack_exports;
+	}
+});
 
-//# sourceMappingURL=compose-xw86kVYi.cjs.map
+//# sourceMappingURL=compose-BvrhDwJ6.cjs.map