@geekmidas/cli 10.0.0-alpha.88 → 10.0.0-alpha.89

package/dist/{seeds-CsI0A_Ef.cjs → seeds-CN6tB-va.cjs}

@@ -1,12 +1,12 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-tr26-KML.cjs");
+const require_credentials = require("./credentials-BKfIugu2.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CT0JM3Y8.cjs");
+const require_workspace = require("./workspace-CwW3Gkru.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
-const require_resolve = require("./resolve-BXeXzpmU.cjs");
+const require_resolve = require("./resolve-dlKPFNgv.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -31,6 +31,7 @@ let _aws_sdk_client_sns = require("@aws-sdk/client-sns");
 let _aws_sdk_client_sqs = require("@aws-sdk/client-sqs");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
+let node_dns_promises = require("node:dns/promises");
 let _geekmidas_storage_s3_url = require("@geekmidas/storage/s3-url");
 _geekmidas_storage_s3_url = require_rolldown_runtime.__toESM(_geekmidas_storage_s3_url, 1);
 //#region src/workspace/rootSite.ts
@@ -77,11 +78,11 @@ var AmbiguousRootSite = class extends Error {
 };
 //#endregion
 //#region src/target/dokploy/domain.ts
-/** A stage was deployed that `deploy.domains` gives no domain. */
+/** A stage was deployed that `domains` gives no domain. */
 var NoDomainForStage = class extends Error {
 	stage;
 	constructor(stage) {
-		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: domains: { ${stage}: 'example.com' }.`);
 		this.stage = stage;
 		this.name = "NoDomainForStage";
 	}
@@ -90,11 +91,11 @@ var NoDomainForStage = class extends Error {
 * The hostname an app answers on for a stage.
 *
 * 1. An explicit `app.domain` — a string, or one per stage — wins.
-* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+* 2. Otherwise from the stage's base domain in `domains`: the root site
 *    answers on the domain itself, and every other app on
 *    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
 *
-* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
+* @throws {NoDomainForStage} when `domains` names no domain for it
 */
 function resolveHost(appName, app, stage, domains, isMainFrontend) {
 	if (app.domain) {
@@ -303,6 +304,11 @@ function logsAccess(logs, ctx) {
 }
 //#endregion
 //#region src/secrets/storage.ts
+/**
+* What a stage's secrets are, independent of where they are kept: building
+* them, changing them, and handing them to a process. Where they are kept is a
+* {@link SecretsStore}'s business — see `secretsStoreFor`.
+*/
 var storage_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	initStageSecrets: () => initStageSecrets,
 	maskPassword: () => maskPassword,
@@ -331,7 +337,7 @@ function initStageSecrets(stage) {
 function toEmbeddableSecrets(secrets) {
 	return {
 		...secrets.urls,
-		...secrets.custom,
+		...Object.fromEntries(Object.entries(secrets.custom).filter(([key]) => !require_workspace.isReservedStageKey(key))),
 		...secrets.services.postgres && {
 			POSTGRES_USER: secrets.services.postgres.username,
 			POSTGRES_PASSWORD: secrets.services.postgres.password,
@@ -857,7 +863,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$1 = console;
+const logger$2 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -908,7 +914,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -945,7 +951,7 @@ async function savePortState(workspaceRoot, ports) {
 async function loadSecretsForApp(store, stage) {
 	const stageSecrets = await store.read(stage);
 	if (!stageSecrets) return {};
-	logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+	logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
 	return toEmbeddableSecrets(stageSecrets);
 }
 /**
@@ -1043,7 +1049,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -1067,7 +1073,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
 	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
@@ -6774,6 +6780,14 @@ function requiredStageKeys(input) {
 			...apps(d)
 		});
 	}
+	if (!input.local && input.server) add({
+		key: require_workspace.SERVER_IPV4_KEY,
+		id: "server",
+		kind: "server",
+		what: "the public IPv4 address of the server the stage's stack runs on — its hosts' DNS records point at it, and every deploy checks they do",
+		note: `${require_workspace.SERVER_IPV6_KEY} adds its IPv6 address (AAAA records); neither is ever handed to an app`,
+		example: "203.0.113.10"
+	});
 	for (const d of byId(input.credentials)) add({
 		key: (0, _geekmidas_manifest.provideKey)(d.id, "credentials"),
 		id: d.id,
@@ -7204,17 +7218,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-CLwa2DpK.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-CUWh2BWU.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-CWG_HVC0.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-BaBoYl59.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-aBOTF018.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DIzbiqCz.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7224,7 +7238,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-Cea9_5gF.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-O8EYfjfG.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7237,6 +7251,576 @@ async function createStateStore(options) {
 	throw new UnknownStateProvider(config);
 }
 //#endregion
+//#region src/target/dokploy/dns/DnsProvider.ts
+/**
+* Check if value is a DnsProvider implementation.
+*/
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+}
+/**
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'godaddy': GoDaddyProvider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
+*/
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-CyTpG_jy.cjs"));
+		return new HostingerProvider();
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-Bllus2NR.cjs"));
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
+		});
+	}
+	if (provider === "godaddy") {
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-DnRor066.cjs"));
+		return new GoDaddyProvider(options.godaddy ?? {});
+	}
+	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
+	throw new DnsProviderUnknown(config);
+}
+/**
+* The provider's credentials can write records and not read them — a key
+* scoped to updates only. What reads them falls back to writing every record,
+* which is idempotent, without a diff.
+*/
+var DnsRecordsUnreadable = class extends Error {
+	provider;
+	domain;
+	reason;
+	constructor(provider, domain, reason) {
+		super(`The ${provider} key cannot read ${domain}'s DNS records (${reason}), so changes cannot be compared with what is there: every record is written, which leaves one that already has its value as it was.`);
+		this.provider = provider;
+		this.domain = domain;
+		this.reason = reason;
+		this.name = "DnsRecordsUnreadable";
+	}
+};
+/** A DNS provider gkm names and does not have yet. */
+var DnsProviderNotImplemented = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The ${provider} DNS provider is not implemented yet. Use 'route53', 'godaddy', 'hostinger' or 'manual' for this domain in dns, or pass your own DnsProvider object.`);
+		this.provider = provider;
+		this.name = "DnsProviderNotImplemented";
+	}
+};
+/** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
+var DnsProviderUnknown = class extends Error {
+	config;
+	constructor(config) {
+		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
+		this.config = config;
+		this.name = "DnsProviderUnknown";
+	}
+};
+//#endregion
+//#region src/deploy/state.ts
+/**
+* Deploy state management for Dokploy deployments
+*
+* Stores resource IDs (applications, services) per stage to avoid
+* re-creating resources on subsequent deploys.
+*/
+/**
+* Create a new empty state for a stage
+*/
+function createEmptyState(stage, projectId, environmentId) {
+	return {
+		provider: "dokploy",
+		stage,
+		projectId,
+		environmentId,
+		applications: {},
+		services: {},
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Set application ID in state (mutates state)
+*/
+function setApplicationId(state, appName, applicationId) {
+	state.applications[appName] = applicationId;
+}
+/** Two records naming the same image: by digest when both have one. */
+function sameImage(a, b) {
+	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
+}
+/** The newest release in `history` after `index` that a rollback may restore. */
+function restorable(history, index, current) {
+	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
+}
+/**
+* Record that `image` went live for `appName` (mutates state): it becomes
+* `current`, and what was current becomes `previous`. Releasing what already
+* runs — a redeploy of the same digest — changes nothing.
+*/
+function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+	const releases = state.releases?.[appName];
+	if (releases && sameImage(releases.current, image)) return;
+	const entry = {
+		...image,
+		releasedAt: releasedAt.toISOString()
+	};
+	const history = [entry, ...releases?.history ?? []].slice(0, 10);
+	const previous = releases?.current;
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current: entry,
+			...previous ? { previous } : {},
+			history
+		}
+	};
+}
+/**
+* Record that `appName` was rolled back to `to` (mutates state): every
+* release newer than it is marked rolled back, so neither this rollback nor
+* a later one restores it, and `previous` moves to the release before `to`.
+*/
+function recordRollback(state, appName, to) {
+	const releases = state.releases?.[appName];
+	if (!releases) return;
+	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
+	if (index === -1) return;
+	const history = releases.history.map((entry, i) => i < index ? {
+		...entry,
+		rolledBack: true
+	} : entry);
+	const current = history[index];
+	const previous = restorable(history, index, current);
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current,
+			...previous ? { previous } : {},
+			history
+		}
+	};
+}
+/**
+* Get a generated secret for an app
+*/
+function getGeneratedSecret(state, appName, secretName) {
+	return state?.generatedSecrets?.[appName]?.[secretName];
+}
+/**
+* Set a generated secret for an app (mutates state)
+*/
+function setGeneratedSecret(state, appName, secretName, value) {
+	if (!state.generatedSecrets) state.generatedSecrets = {};
+	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
+	state.generatedSecrets[appName][secretName] = value;
+}
+/**
+* Set DNS verification record for a hostname (mutates state)
+*/
+function setDnsVerification(state, hostname, serverIp) {
+	if (!state.dnsVerified) state.dnsVerified = {};
+	state.dnsVerified[hostname] = {
+		serverIp,
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Check if a hostname is already verified with the given IP
+*/
+function isDnsVerified(state, hostname, serverIp) {
+	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
+}
+/**
+* Get the key for a DNS record in state
+*/
+function getDnsRecordKey(name, type) {
+	return `${name}:${type}`;
+}
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Get backup state from state
+*/
+function getBackupState(state) {
+	return state?.backups;
+}
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
+}
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
+}
+//#endregion
+//#region src/target/dokploy/dns/index.ts
+/**
+* DNS orchestration for deployments
+*
+* Handles automatic DNS record creation for deployed applications.
+*/
+const logger$1 = require_discover.output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
+}
+/**
+* Normalize DNS config to new multi-domain format
+*/
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
+	}
+	return config;
+}
+/**
+* Find the root domain for a hostname from available DNS configs
+*
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
+*/
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
+}
+/**
+* Group hostnames by their root domain
+*/
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$1.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
+	}
+	return grouped;
+}
+/**
+* Resolve IP address from a hostname
+*/
+async function resolveHostnameToIp(hostname) {
+	try {
+		return (await (0, node_dns_promises.lookup)(hostname, { family: 4 })).address;
+	} catch (error) {
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
+	}
+}
+/**
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
+*/
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
+}
+/**
+* Generate required DNS records for a deployment
+*/
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
+}
+/**
+* Print DNS records table
+*/
+function printDnsRecordsTable(records, rootDomain) {
+	logger$1.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$1.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$1.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$1.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$1.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+	}
+	logger$1.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+}
+/**
+* Print DNS records in a simple format for manual setup
+*/
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$1.log("\n   📋 Required DNS Records:");
+	logger$1.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$1.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$1.log("");
+}
+/**
+* Create DNS records for a single domain using its configured provider
+*/
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
+		}));
+	}
+	if (!provider) return records.map((r) => ({
+		...r,
+		created: false,
+		existed: false
+	}));
+	const results = [];
+	const upsertRecords = records.map((r) => ({
+		name: r.subdomain,
+		type: r.type,
+		ttl,
+		value: r.value
+	}));
+	try {
+		const upsertResults = await provider.upsertRecords(rootDomain, upsertRecords);
+		for (const [i, record] of records.entries()) {
+			const result = upsertResults[i];
+			if (!result) {
+				results.push({
+					hostname: record.hostname,
+					subdomain: record.subdomain,
+					type: record.type,
+					value: record.value,
+					appName: record.appName,
+					error: "No result returned from provider"
+				});
+				continue;
+			}
+			if (result.unchanged) results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				existed: true,
+				created: false
+			});
+			else results.push({
+				hostname: record.hostname,
+				subdomain: record.subdomain,
+				type: record.type,
+				value: record.value,
+				appName: record.appName,
+				created: result.created,
+				existed: !result.created
+			});
+		}
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			hostname: r.hostname,
+			subdomain: r.subdomain,
+			type: r.type,
+			value: r.value,
+			appName: r.appName,
+			error: message
+		}));
+	}
+	return results;
+}
+/**
+* Main DNS orchestration function for deployments
+*
+* Supports both legacy single-domain format and new multi-domain format:
+* - Legacy: { provider: 'hostinger', domain: 'example.com' }
+* - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+*
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
+*/
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
+	if (!dnsConfig) return null;
+	const normalizedConfig = normalizeDnsConfig(dnsConfig);
+	logger$1.log("\n🌐 Setting up DNS records...");
+	let serverIp;
+	try {
+		const endpointUrl = new URL(dokployEndpoint);
+		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
+		logger$1.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		return null;
+	}
+	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
+	if (groupedHostnames.size === 0) {
+		logger$1.log("   No DNS records needed (no hostnames match configured domains)");
+		return {
+			records: [],
+			success: true,
+			serverIp
+		};
+	}
+	const allRecords = [];
+	let hasFailures = false;
+	for (const [rootDomain, domainHostnames] of groupedHostnames) {
+		const providerConfig = normalizedConfig[rootDomain];
+		if (!providerConfig) {
+			logger$1.log(`   ⚠ No provider config for ${rootDomain}`);
+			continue;
+		}
+		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
+		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
+		if (requiredRecords.length === 0) continue;
+		logger$1.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
+		allRecords.push(...domainRecords);
+		const created = domainRecords.filter((r) => r.created).length;
+		const existed = domainRecords.filter((r) => r.existed).length;
+		const failed = domainRecords.filter((r) => r.error).length;
+		if (created > 0) logger$1.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$1.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (failed > 0) {
+			logger$1.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			hasFailures = true;
+		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
+		printDnsRecordsTable(domainRecords, rootDomain);
+		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
+	}
+	return {
+		records: allRecords,
+		success: !hasFailures,
+		serverIp
+	};
+}
+/**
+* Verify DNS records resolve correctly after deployment.
+*
+* This function:
+* 1. Checks state for previously verified hostnames (skips if already verified with same IP)
+* 2. Attempts to resolve each hostname to an IP
+* 3. Compares resolved IP with expected server IP
+* 4. Updates state with verification results
+*
+* @param appHostnames - Map of app names to hostnames
+* @param serverIp - Expected IP address the hostnames should resolve to
+* @param state - Deploy state for caching verification results
+* @returns Array of verification results
+*/
+async function verifyDnsRecords(appHostnames, serverIp, state) {
+	const results = [];
+	logger$1.log("\n🔍 Verifying DNS records...");
+	for (const [appName, hostname] of appHostnames) {
+		if (isDnsVerified(state, hostname, serverIp)) {
+			logger$1.log(`   ✓ ${hostname} (previously verified)`);
+			results.push({
+				hostname,
+				appName,
+				verified: true,
+				expectedIp: serverIp,
+				skipped: true
+			});
+			continue;
+		}
+		try {
+			const resolvedIp = await resolveHostnameToIp(hostname);
+			if (resolvedIp === serverIp) {
+				setDnsVerification(state, hostname, serverIp);
+				logger$1.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: true,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			} else {
+				logger$1.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				results.push({
+					hostname,
+					appName,
+					verified: false,
+					resolvedIp,
+					expectedIp: serverIp
+				});
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$1.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			results.push({
+				hostname,
+				appName,
+				verified: false,
+				expectedIp: serverIp,
+				error: message
+			});
+		}
+	}
+	const verified = results.filter((r) => r.verified).length;
+	const skipped = results.filter((r) => r.skipped).length;
+	const pending = results.filter((r) => !r.verified).length;
+	if (pending > 0) {
+		logger$1.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$1.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$1.log(`   ${verified} verified (${skipped} from cache)`);
+	return results;
+}
+//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -7720,155 +8304,6 @@ var DeployJournal = class DeployJournal {
 	}
 };
 //#endregion
-//#region src/deploy/state.ts
-/**
-* Deploy state management for Dokploy deployments
-*
-* Stores resource IDs (applications, services) per stage to avoid
-* re-creating resources on subsequent deploys.
-*/
-/**
-* Create a new empty state for a stage
-*/
-function createEmptyState(stage, projectId, environmentId) {
-	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/** Two records naming the same image: by digest when both have one. */
-function sameImage(a, b) {
-	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
-}
-/** The newest release in `history` after `index` that a rollback may restore. */
-function restorable(history, index, current) {
-	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
-}
-/**
-* Record that `image` went live for `appName` (mutates state): it becomes
-* `current`, and what was current becomes `previous`. Releasing what already
-* runs — a redeploy of the same digest — changes nothing.
-*/
-function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
-	const releases = state.releases?.[appName];
-	if (releases && sameImage(releases.current, image)) return;
-	const entry = {
-		...image,
-		releasedAt: releasedAt.toISOString()
-	};
-	const history = [entry, ...releases?.history ?? []].slice(0, 10);
-	const previous = releases?.current;
-	state.releases = {
-		...state.releases,
-		[appName]: {
-			current: entry,
-			...previous ? { previous } : {},
-			history
-		}
-	};
-}
-/**
-* Record that `appName` was rolled back to `to` (mutates state): every
-* release newer than it is marked rolled back, so neither this rollback nor
-* a later one restores it, and `previous` moves to the release before `to`.
-*/
-function recordRollback(state, appName, to) {
-	const releases = state.releases?.[appName];
-	if (!releases) return;
-	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
-	if (index === -1) return;
-	const history = releases.history.map((entry, i) => i < index ? {
-		...entry,
-		rolledBack: true
-	} : entry);
-	const current = history[index];
-	const previous = restorable(history, index, current);
-	state.releases = {
-		...state.releases,
-		[appName]: {
-			current,
-			...previous ? { previous } : {},
-			history
-		}
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
-*/
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
-}
-/**
-* Set a created DNS record in state (mutates state)
-*/
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Get backup state from state
-*/
-function getBackupState(state) {
-	return state?.backups;
-}
-/**
-* Set backup state (mutates state)
-*/
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
-}
-//#endregion
 //#region src/providers/aws.ts
 /**
 * The AWS account a provider provisions in — the stage's, found the way the
@@ -8064,7 +8499,7 @@ function bucketOrigins(input) {
 			continue;
 		}
 		try {
-			const host = resolveHost(name, app, stage, workspace.deploy?.domains, isMainFrontendApp(name, app, workspace.apps));
+			const host = resolveHost(name, app, stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
 			origins.add(`https://${host}`);
 		} catch (error) {
 			if (!(error instanceof NoDomainForStage)) throw error;
@@ -8506,7 +8941,7 @@ async function ensureBucketSettings(ctx, clients, input) {
 		stage: ctx.stage,
 		bucket: id
 	});
-	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (deploy.domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
+	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
 	if (origins.length === 0) return;
 	const rule = corsRule(origins);
 	const cors = await read(() => s3.send(new S3.GetBucketCorsCommand({ Bucket })), ["NoSuchCORSConfiguration"]);
@@ -9103,6 +9538,12 @@ Object.defineProperty(exports, "DevServicesNeedServerTarget", {
 		return DevServicesNeedServerTarget;
 	}
 });
+Object.defineProperty(exports, "DnsRecordsUnreadable", {
+	enumerable: true,
+	get: function() {
+		return DnsRecordsUnreadable;
+	}
+});
 Object.defineProperty(exports, "DockerBuildFailed", {
 	enumerable: true,
 	get: function() {
@@ -9385,6 +9826,12 @@ Object.defineProperty(exports, "createCredentialsPreload", {
 		return createCredentialsPreload;
 	}
 });
+Object.defineProperty(exports, "createDnsProvider", {
+	enumerable: true,
+	get: function() {
+		return createDnsProvider;
+	}
+});
 Object.defineProperty(exports, "createEmptyState", {
 	enumerable: true,
 	get: function() {
@@ -9475,6 +9922,12 @@ Object.defineProperty(exports, "externalServices", {
 		return externalServices;
 	}
 });
+Object.defineProperty(exports, "extractSubdomain", {
+	enumerable: true,
+	get: function() {
+		return extractSubdomain;
+	}
+});
 Object.defineProperty(exports, "fakeKey", {
 	enumerable: true,
 	get: function() {
@@ -9493,6 +9946,12 @@ Object.defineProperty(exports, "findBuildRoot", {
 		return findBuildRoot;
 	}
 });
+Object.defineProperty(exports, "findRootDomain", {
+	enumerable: true,
+	get: function() {
+		return findRootDomain;
+	}
+});
 Object.defineProperty(exports, "forgetState", {
 	enumerable: true,
 	get: function() {
@@ -9553,12 +10012,6 @@ Object.defineProperty(exports, "initStageSecrets", {
 		return initStageSecrets;
 	}
 });
-Object.defineProperty(exports, "isDnsVerified", {
-	enumerable: true,
-	get: function() {
-		return isDnsVerified;
-	}
-});
 Object.defineProperty(exports, "isImageBuild", {
 	enumerable: true,
 	get: function() {
@@ -9673,6 +10126,18 @@ Object.defineProperty(exports, "newLockHolder", {
 		return newLockHolder;
 	}
 });
+Object.defineProperty(exports, "normalizeDnsConfig", {
+	enumerable: true,
+	get: function() {
+		return normalizeDnsConfig;
+	}
+});
+Object.defineProperty(exports, "orchestrateDns", {
+	enumerable: true,
+	get: function() {
+		return orchestrateDns;
+	}
+});
 Object.defineProperty(exports, "ownershipMarker", {
 	enumerable: true,
 	get: function() {
@@ -9871,18 +10336,6 @@ Object.defineProperty(exports, "setBackupState", {
 		return setBackupState;
 	}
 });
-Object.defineProperty(exports, "setDnsRecord", {
-	enumerable: true,
-	get: function() {
-		return setDnsRecord;
-	}
-});
-Object.defineProperty(exports, "setDnsVerification", {
-	enumerable: true,
-	get: function() {
-		return setDnsVerification;
-	}
-});
 Object.defineProperty(exports, "setGeneratedSecret", {
 	enumerable: true,
 	get: function() {
@@ -9973,6 +10426,12 @@ Object.defineProperty(exports, "validateImageRef", {
 		return validateImageRef;
 	}
 });
+Object.defineProperty(exports, "verifyDnsRecords", {
+	enumerable: true,
+	get: function() {
+		return verifyDnsRecords;
+	}
+});
 Object.defineProperty(exports, "verifyStageProviders", {
 	enumerable: true,
 	get: function() {
@@ -10046,4 +10505,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-CsI0A_Ef.cjs.map
+//# sourceMappingURL=seeds-CN6tB-va.cjs.map