@geekmidas/cli 10.0.0-alpha.87 → 10.0.0-alpha.89

package/dist/{compose-DbJhRQlh.mjs → compose-Dn0oAgQ0.mjs}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { c as runOutput, s as run, v as gkmHome } from "./credentials-BgJ5mS_d.mjs";
+import { c as runOutput, s as run, x as gkmHome } from "./credentials-CnVqoXMb.mjs";
 import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { $ as ComposeTlsFileMissing, F as resolveStageTelemetry, L as telemetryEnv, P as otlpTelemetryEnv, R as LOGS_PORT, et as certificateFor, tt as proxyFor } from "./workspace-D2CYLMCW.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as SERVER_IPV6_KEY, it as SERVER_IPV4_KEY, nt as certificateFor, ot as cnameTarget, rt as proxyFor, st as isReservedStageKey, tt as ComposeTlsFileMissing, z as telemetryEnv } from "./workspace-CJ0lKFq-.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as suppliedOnly, $n as stackLogs, At as postgresStatements, Bt as envFor, C as stageProviderNotes, Dt as applyPostgres, E as appDockerfile, Et as applyPolicies, Ft as pgClient, Gt as WORKER_PORT, Ht as composeBuildPaths, It as appEnvKeys, J as devServicesUsed, Mt as LEGACY_LOCAL_LOGIN, Nt as ensurePostgresLogin, O as ensureDockerignore, Ot as bucketPolicies, Pt as bucketClient, Qn as logsService, Rt as networkEnv, St as withRedisPassword, Tt as applyBuckets, Ut as imageLayout, Vt as localRolePassword, Wn as initStageSecrets, Wt as TURBO_VERSION, Xn as LOGS_SERVICE, Z as reportDevServices, Zn as logsAccess, _t as REDIS_SERVICE, bt as runsRedis, cn as isTelemetryKey, ct as constructGlobs, d as recordRelease, dn as telemetryOf, er as withLogsPassword, et as workerUnits, fn as usesTelemetry, ft as LOCAL_RABBITMQ_USER, gn as portKeys, gt as withGeneratedSecrets, i as assertNoStaleSecrets, in as planFor, j as validateImageRef, k as workerDockerfile, ln as scopeTelemetryEnv, mt as postgresSuperuser, n as reportDatabaseRuns, nn as EMULATOR_ACCESS_KEY_ID, nr as isMainFrontendApp, o as verifyStageProviders, on as hostFor, pn as DEFAULT_IMAGES, pt as loadLocalCredentials, q as assertExternalServices, qt as findBuildRoot, r as reportPlannedSeeds, rr as resolveHost, s as createEmptyState, t as DeploySeedsFailed, tn as composeFor, tr as NoDomainForStage, vn as primaryPortKey, vt as STACK_CACHE, x as assertStageProvidersEnabled, xt as stackRedis, y as DeployJournal, yt as redisService, zn as imageRef, zt as workerEnvKeys } from "./seeds-BYdrtZsC.mjs";
+import { At as applyPolicies, Bt as appEnvKeys, Ct as redisService, Et as withRedisPassword, F as createDnsProvider, Gt as localRolePassword, Ht as networkEnv, It as LEGACY_LOCAL_LOGIN, Jn as initStageSecrets, Jt as TURBO_VERSION, Kt as composeBuildPaths, Lt as ensurePostgresLogin, Mt as bucketPolicies, O as recordRelease, P as DnsRecordsUnreadable, Pt as postgresStatements, Q as devServicesUsed, Rt as bucketClient, S as normalizeDnsConfig, Sn as primaryPortKey, St as STACK_CACHE, T as createEmptyState, Tt as stackRedis, Un as imageRef, Ut as workerEnvKeys, Wt as envFor, Yt as WORKER_PORT, Z as assertExternalServices, Zt as findBuildRoot, _ as workerDockerfile, _n as DEFAULT_IMAGES, _t as loadLocalCredentials, an as composeFor, ar as NoDomainForStage, b as extractSubdomain, bn as portKeys, bt as withGeneratedSecrets, cn as planFor, d as stageProviderNotes, er as LOGS_SERVICE, fn as isTelemetryKey, ft as constructGlobs, g as ensureDockerignore, gn as usesTelemetry, gt as LOCAL_RABBITMQ_USER, hn as telemetryOf, i as assertNoStaleSecrets, ir as withLogsPassword, it as workerUnits, jt as applyPostgres, kt as applyBuckets, l as assertStageProvidersEnabled, m as appDockerfile, n as reportDatabaseRuns, nr as logsService, o as verifyStageProviders, on as EMULATOR_ACCESS_KEY_ID, or as isMainFrontendApp, pn as scopeTelemetryEnv, qt as imageLayout, r as reportPlannedSeeds, rr as stackLogs, rt as suppliedOnly, s as DeployJournal, sr as resolveHost, t as DeploySeedsFailed, tr as logsAccess, tt as reportDevServices, un as hostFor, vt as postgresSuperuser, wt as runsRedis, x as findRootDomain, xt as REDIS_SERVICE, y as validateImageRef, zt as pgClient } from "./seeds-perzdN81.mjs";
 import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-BPqQf8fB.mjs";
 import { i as installedFrom } from "./drivers-DTZzxeIl.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-CzszQV0N.mjs";
@@ -14,10 +14,428 @@ import { existsSync } from "node:fs";
 import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { hostname, userInfo } from "node:os";
 import { CLIENT_IP_HEADER, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { isIPv4, isIPv6 } from "node:net";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { stringify } from "yaml";
+import { lookup } from "node:dns/promises";
 import { request } from "node:https";
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends Error {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends Error {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !isIPv6(ipv6)) throw new ServerAddressInvalid(stage, SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!isIPv4(ipv4)) throw new ServerAddressInvalid(stage, SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await lookup(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends Error {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
 //#region src/compose/docker.ts
 /**
 * The Docker operations `gkm compose` needs, behind an interface.
@@ -794,6 +1212,36 @@ function pinImages(file, digests, images) {
 	});
 }
 //#endregion
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ __exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	const withLogs = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /**
 * The stack's own edge, rendered for Caddy: one site block per route.
@@ -878,6 +1326,21 @@ const HEADER = `# Generated by gkm compose from the construct manifest — do no
 * address and once on the compose network, because a browser and a sibling
 * service reach the same API by different names.
 */
+var stack_exports = /* @__PURE__ */ __exportAll({
+	EDGE_PORT_ENV: () => EDGE_PORT_ENV,
+	EnvValueMultiline: () => EnvValueMultiline,
+	LOGS_PORT_ENV: () => LOGS_PORT_ENV,
+	LOG_ROTATION: () => LOG_ROTATION,
+	LocalCredentialsMissing: () => LocalCredentialsMissing,
+	NothingToCompose: () => NothingToCompose,
+	StageSecretMissing: () => StageSecretMissing,
+	StageSeedMissing: () => StageSeedMissing,
+	composeProject: () => composeProject,
+	composeStack: () => composeStack,
+	derivedCredentials: () => derivedCredentials,
+	envFile: () => envFile,
+	stackDir: () => stackDir
+});
 /** Where a stack's files are written, relative to the workspace root. */
 function stackDir(stage) {
 	return `.gkm/compose/${stage}`;
@@ -1111,7 +1574,7 @@ function composeStack(input) {
 		reads.set(app.name, site?.kind === "site" ? Object.values(publicEnvFor(site, manifest)) : [...appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
 	for (const worker of workers) reads.set(worker.name, [...workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
-	const domain = workspace.deploy?.domains?.[stage];
+	const domain = workspace.domains?.[stage];
 	const telemetry = resolveStageTelemetry({
 		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
 		stage,
@@ -1226,6 +1689,7 @@ function composeStack(input) {
 	* they can hold it, and the derivations otherwise.
 	*/
 	const valueFor = (app, key, owner) => {
+		if (isReservedStageKey(key)) return void 0;
 		if (owner && SERVICE_KINDS[owner.kind]) {
 			if (custom[key] !== void 0) return custom[key];
 			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
@@ -1509,7 +1973,7 @@ function stackWorkers(units, options) {
 */
 function hostOf(name, app, workspace, resource, options) {
 	if (options.local) return hostFor(resource, workspace.name);
-	return resolveHost(name, app, options.stage, workspace.deploy?.domains, isMainFrontendApp(name, app, workspace.apps));
+	return resolveHost(name, app, options.stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
 }
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
@@ -1840,7 +2304,8 @@ const defaultDeps = {
 	probe: httpsProbe,
 	healthAttempts: 90,
 	healthIntervalMs: 2e3,
-	env: process.env
+	env: process.env,
+	lookup: systemLookup
 };
 /**
 * The stack the stage would run, and — for a tag — the registry's word that
@@ -1865,6 +2330,7 @@ async function validateCompose(ctx, deps, options = {}) {
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const server = push || stage === workspace.stages.local ? void 0 : requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
 	if (!push) {
 		assertNoStaleSecrets({
 			manifest,
@@ -1915,6 +2381,7 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (stack.tls && !push) {
 		for (const file of [stack.tls.certFile, stack.tls.keyFile]) if (!existsSync(file)) throw new ComposeTlsFileMissing(stage, file);
 	}
+	if (!push && !stack.local) await checkDns(ctx, deps, stackHosts(stack).filter((host) => !isLocalHost(host)), server);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
@@ -1982,35 +2449,46 @@ function assertRedisClient(workspace, stack) {
 * run goes ahead (`provision`), so a dry run, or a tag that is not there,
 * leaves the stage's secrets as it found them.
 */
+/**
+* The deploy-time DNS check: each public host resolved with the system
+* resolver and compared with the server's address from the stage's secrets.
+* A dry run warns rather than stops.
+*/
+async function checkDns(ctx, deps, hosts, server) {
+	const { workspace, stage } = ctx;
+	if (hosts.length === 0) return;
+	if (ctx.skipDnsCheck) {
+		ctx.logger.info("🌐 DNS check skipped (--skip-dns-check)");
+		return;
+	}
+	if (!server) {
+		ctx.logger.info(`🌐 DNS check skipped: no ${SERVER_IPV4_KEY} in '${stage}''s secrets — ${serverAddressHint(stage)}`);
+		return;
+	}
+	try {
+		const ok = await checkStackDns({
+			stage,
+			hosts,
+			server,
+			dns: workspace.dns,
+			lookup: deps.lookup ?? systemLookup
+		});
+		ctx.logger.info(`🌐 ${ok.length} host${ok.length === 1 ? "" : "s"} resolve${ok.length === 1 ? "s" : ""} to ${server.ipv4}`);
+	} catch (error) {
+		if (ctx.dryRun && error instanceof HostNotPointingAtServer) {
+			ctx.logger.warn(`⚠ ${error.message}`);
+			return;
+		}
+		throw error;
+	}
+}
 async function stageSecrets(ctx, manifest) {
 	const stored = await ctx.secrets.read();
 	if (ctx.stage === ctx.workspace.stages.local) return {
 		secrets: stored,
 		generated: []
 	};
-	const withSeed = withGeneratedSecrets(stored ?? initStageSecrets(ctx.stage), manifest);
-	const withLogs = resolveStageTelemetry({
-		...ctx.workspace.deploy?.telemetry ? { telemetry: ctx.workspace.deploy.telemetry } : {},
-		stage: ctx.stage,
-		local: false,
-		target: "compose",
-		runtime: "server",
-		selfHosted: true,
-		used: usesTelemetry(manifest)
-	})?.provider === "self-hosted" ? withLogsPassword(withSeed.secrets) : {
-		secrets: withSeed.secrets,
-		generated: []
-	};
-	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
-		secrets: withLogs.secrets,
-		generated: []
-	};
-	const secrets = withRedis.secrets;
-	const generated = [
-		...withSeed.generated,
-		...withLogs.generated,
-		...withRedis.generated
-	];
+	const { secrets, generated } = deployedStackSecrets(ctx.workspace, ctx.stage, stored, manifest);
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -2657,6 +3135,6 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
-export { stackOverrideFile as a, parseDigests as c, removeEdgeRoutes as d, EDGE_PROJECT as f, ComposePushNeedsBuild as i, pinnedRef as l, compose_exports as n, composeProject as o, dockerCompose as p, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, edgeDir as u };
+export { planStackDns as _, stackOverrideFile as a, serverAddressHint as b, stack_exports as c, pinnedRef as d, edgeDir as f, applyStackDns as g, dockerCompose as h, ComposePushNeedsBuild as i, secrets_exports as l, EDGE_PROJECT as m, compose_exports as n, composeProject as o, removeEdgeRoutes as p, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, parseDigests as u, requiredServerAddress as v, stackHosts as x, serverAddress as y };
 
-//# sourceMappingURL=compose-DbJhRQlh.mjs.map
+//# sourceMappingURL=compose-Dn0oAgQ0.mjs.map