@geekmidas/cli 10.0.0-alpha.91 → 10.0.0-alpha.93

package/dist/{seeds-odfgSCmu.mjs → seeds-BSL55F6q.mjs}

@@ -1,12 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { r as storedCredentials, s as run$1, x as gkmHome } from "./credentials-CnVqoXMb.mjs";
-import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { r as storedCredentials, s as run$1, t as MissingCredential, x as gkmHome } from "./credentials-C4KII3PD.mjs";
+import { d as output, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-CJ0lKFq-.mjs";
+import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, ot as cnameTarget, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-Bzw7Zs82.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
-import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
-import { c as runtimeOf } from "./resolve-DNg0icnh.mjs";
+import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
+import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
+import { c as runtimeOf } from "./resolve-Ccjlpnd9.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -15,7 +16,7 @@ import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
 import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
-import { createServer } from "node:net";
+import { createServer, isIPv4, isIPv6 } from "node:net";
 import { execFile, spawn } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { config } from "dotenv";
@@ -63,7 +64,7 @@ function rootSite(sites) {
 	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
 }
 /** Several sites could hold the base domain, and none of them says it does. */
-var AmbiguousRootSite = class extends Error {
+var AmbiguousRootSite = class extends GkmError {
 	sites;
 	tooMany;
 	constructor(sites, tooMany = false) {
@@ -76,7 +77,7 @@ var AmbiguousRootSite = class extends Error {
 //#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `domains` gives no domain. */
-var NoDomainForStage = class extends Error {
+var NoDomainForStage = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`No domain for stage "${stage}". Add it to gkm.config.ts: domains: { ${stage}: 'example.com' }.`);
@@ -167,7 +168,7 @@ const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
 */
 const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
 /** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
+var LogsPasswordWeak = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
@@ -176,7 +177,7 @@ var LogsPasswordWeak = class extends Error {
 	}
 };
 /** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
+var LogsPasswordMissing = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -433,7 +434,7 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 * `DeployIdentity` is what a deploy names and claims its resources by instead.
 */
 /** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends Error {
+var DeployNamespaceInvalid = class extends GkmError {
 	namespace;
 	constructor(namespace) {
 		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
@@ -442,7 +443,7 @@ var DeployNamespaceInvalid = class extends Error {
 	}
 };
 /** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends Error {
+var DeployProjectNameInvalid = class extends GkmError {
 	workspaceName;
 	constructor(workspaceName) {
 		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
@@ -548,7 +549,7 @@ function applicationName(identity, app) {
 /** Key length for AES-256 encryption */
 const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
-var KeystoreProjectInvalid = class extends Error {
+var KeystoreProjectInvalid = class extends GkmError {
 	key;
 	constructor(key) {
 		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
@@ -557,7 +558,7 @@ var KeystoreProjectInvalid = class extends Error {
 	}
 };
 /** A stage has no key, here or at the place keys used to be kept. */
-var KeyNotFound = class extends Error {
+var KeyNotFound = class extends GkmError {
 	stage;
 	project;
 	path;
@@ -754,7 +755,7 @@ var FileSecretsStore = class {
 	}
 };
 /** A stage's secrets file exists, and the key that opens it does not. */
-var MissingSecretsKey = class extends Error {
+var MissingSecretsKey = class extends GkmError {
 	stage;
 	project;
 	path;
@@ -829,7 +830,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "ssm": {
-			const { AwsSecretsStore } = await import("./aws-B-6uEhgP.mjs").then((n) => n.t);
+			const { AwsSecretsStore } = await import("./aws-Dz2bYxK1.mjs").then((n) => n.t);
 			return new AwsSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -838,7 +839,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 		}
 		case "secrets-manager": {
 			const { kmsKeyId } = config;
-			const { SecretsManagerSecretsStore } = await import("./secretsManager-Chs9VV2r.mjs").then((n) => n.n);
+			const { SecretsManagerSecretsStore } = await import("./secretsManager-C6wm-9uZ.mjs").then((n) => n.n);
 			return new SecretsManagerSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -1842,7 +1843,7 @@ function planFor(manifest, stage, order, options = {}) {
 * code either way — declare a database, or select a backend that brings its own
 * broker.
 */
-var CacheNeedsDatabase = class extends Error {
+var CacheNeedsDatabase = class extends GkmError {
 	ids;
 	constructor(ids) {
 		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
@@ -1861,7 +1862,7 @@ var CacheNeedsDatabase = class extends Error {
 * `orders.cache('Sessions')` names the database, which is a fact about the
 * application rather than a deployment choice.
 */
-var CacheIsAmbiguous = class extends Error {
+var CacheIsAmbiguous = class extends GkmError {
 	ids;
 	databases;
 	constructor(ids, databases) {
@@ -1871,7 +1872,7 @@ var CacheIsAmbiguous = class extends Error {
 		this.name = "CacheIsAmbiguous";
 	}
 };
-var PgBossNeedsDatabase = class extends Error {
+var PgBossNeedsDatabase = class extends GkmError {
 	ids;
 	constructor(ids) {
 		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
@@ -3127,7 +3128,7 @@ CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile
 * prune` to one app's slice. Nothing is built on the host.
 */
 /** A workspace of packages with no turbo.json, which every image prunes with. */
-var MonorepoNeedsTurbo = class extends Error {
+var MonorepoNeedsTurbo = class extends GkmError {
 	buildRoot;
 	constructor(buildRoot) {
 		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
@@ -3666,7 +3667,7 @@ function schemaOf(resource, plan) {
 * On SNS each topic and queue is its own address, so there is no project-wide
 * one to hand out — a cron's schedule store, say, cannot live there.
 */
-var UnprovisionedEventsBackend = class extends Error {
+var UnprovisionedEventsBackend = class extends GkmError {
 	backend;
 	constructor(backend) {
 		super(`'${backend}' has no single broker address: each topic and queue is addressed by its own ARN. Something asked for one without naming the topic or queue.`);
@@ -4299,7 +4300,7 @@ const LEGACY_LOCAL_LOGIN = Object.freeze({
 	password: "geekmidas"
 });
 /** No login this workspace knows opens its Postgres. */
-var PostgresLoginRefused = class extends Error {
+var PostgresLoginRefused = class extends GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4310,7 +4311,7 @@ var PostgresLoginRefused = class extends Error {
 	}
 };
 /** No login this workspace knows opens its MinIO. */
-var MinioLoginRefused = class extends Error {
+var MinioLoginRefused = class extends GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4657,7 +4658,7 @@ async function heldElsewhere(kept, keys, observed, probe, ours) {
 	return held;
 }
 /** The window was exhausted. */
-var NoPortAvailable = class extends Error {
+var NoPortAvailable = class extends GkmError {
 	/** Where the search started. */
 	from;
 	/** The window searched, so the caller can report what was full. */
@@ -5403,7 +5404,7 @@ const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
 /** Redis's own count of logical databases, before `--databases` raises it. */
 const REDIS_DATABASES = 16;
 /** A deployed stage that runs the stack's Redis and has no password yet. */
-var RedisPasswordMissing = class extends Error {
+var RedisPasswordMissing = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -5637,7 +5638,7 @@ function localCredentialsPath(project) {
 	return join(project.home ?? gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
-var LocalCredentialsKeyMissing = class extends Error {
+var LocalCredentialsKeyMissing = class extends GkmError {
 	path;
 	stage;
 	constructor(path, stage) {
@@ -5648,7 +5649,7 @@ var LocalCredentialsKeyMissing = class extends Error {
 	}
 };
 /** Another gkm held the logins file's lock for longer than any write takes. */
-var LocalCredentialsLocked = class extends Error {
+var LocalCredentialsLocked = class extends GkmError {
 	lock;
 	constructor(lock) {
 		super(`Another gkm has been writing the local logins for over ${LOCK_TIMEOUT_MS / 1e3}s. If none is running, remove ${lock} and run the command again.`);
@@ -6348,7 +6349,7 @@ export async function stopQueues(): Promise<void> {
 * reached by building server images for a project that deploys to AWS — where
 * a subscriber is a Lambda instead.
 */
-var WorkerSubscribersNeedPush = class extends Error {
+var WorkerSubscribersNeedPush = class extends GkmError {
 	worker;
 	subscribers;
 	constructor(worker, subscribers) {
@@ -6579,7 +6580,7 @@ logger.info({ port }, 'Worker started');
 //#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
-var WorkerHasNoApp = class extends Error {
+var WorkerHasNoApp = class extends GkmError {
 	worker;
 	constructor(worker) {
 		super(`The worker '${worker}' has crons, queues or subscribers, and the workspace has no backend app that builds a server to carry its entry. Declare a RestApi whose app holds the worker's code.`);
@@ -6588,7 +6589,7 @@ var WorkerHasNoApp = class extends Error {
 	}
 };
 /** A worker whose service name an app already has. */
-var WorkerNameTaken = class extends Error {
+var WorkerNameTaken = class extends GkmError {
 	worker;
 	service;
 	constructor(worker, service) {
@@ -6688,7 +6689,7 @@ const DEV_SERVICES = ["minio", "mailpit"];
 */
 const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
 /** Dev services asked of a target that runs no containers. */
-var DevServicesNeedServerTarget = class extends Error {
+var DevServicesNeedServerTarget = class extends GkmError {
 	target;
 	constructor(target) {
 		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services.`);
@@ -6701,7 +6702,7 @@ var DevServicesNeedServerTarget = class extends Error {
 * switch now: every construct the stage does not account for gets its dev
 * service.
 */
-var AllowDevServicesTakesNoValue = class extends Error {
+var AllowDevServicesTakesNoValue = class extends GkmError {
 	value;
 	constructor(value) {
 		super(`--allow-dev-services takes no value (it was given '${value}'). It runs the dev service for every bucket and mail the stage does not account for — no key in its secrets, no provider in deploy.<kind>.<stage> — so there is nothing to list. Pass --allow-dev-services on its own.`);
@@ -6729,7 +6730,7 @@ function assertDevServicesFlag(argv) {
 * A deployed stage with mail or object storage that its secrets do not
 * configure — every missing key, across every app, at once.
 */
-var ExternalServicesNotConfigured = class extends Error {
+var ExternalServicesNotConfigured = class extends GkmError {
 	stage;
 	missing;
 	constructor(stage, missing) {
@@ -6946,6 +6947,126 @@ function reportDevServices(ctx, uses) {
 	}
 }
 //#endregion
+//#region src/deploy/actor.ts
+/**
+* Who wrote a stage's deploy state: a GitHub Actions run, or a person at a
+* machine. Recorded on every state write (`updatedBy`), on every resource
+* record and on every release (`releasedBy`), so "who put this here" has an
+* answer that does not depend on anyone's memory.
+*/
+/** Whether `env` is a CI job — GitHub Actions or any runner that sets `CI`. */
+function isCi(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" || env.CI === "true";
+}
+/** Who this process is writing as. */
+function currentActor(env = process.env) {
+	if (env.GITHUB_ACTIONS === "true") {
+		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+		return {
+			kind: "github",
+			actor: env.GITHUB_ACTOR ?? "unknown",
+			run: `${server}/${env.GITHUB_REPOSITORY ?? "unknown"}/actions/runs/${env.GITHUB_RUN_ID ?? "unknown"}`,
+			...env.GITHUB_WORKFLOW ? { workflow: env.GITHUB_WORKFLOW } : {}
+		};
+	}
+	let user = "unknown";
+	try {
+		user = userInfo().username;
+	} catch {}
+	return {
+		kind: "local",
+		user,
+		host: hostname()
+	};
+}
+/** `octocat (deploy, https://github.com/…/runs/1)` or `ada@laptop`. */
+function describeActor(actor) {
+	if (!actor) return "unknown";
+	if (actor.kind === "local") return `${actor.user}@${actor.host}`;
+	return `${actor.actor} (${actor.workflow ? `${actor.workflow}, ` : ""}${actor.run})`;
+}
+//#endregion
+//#region src/deploy/dnsResources.ts
+/** The resource type of a DNS record gkm wrote. */
+const DNS_RECORD_RESOURCE = "dns-record";
+/** A record's full name: `api.example.com`, or the domain for `@`. */
+function dnsRecordFqdn(domain, name) {
+	return name === "@" || name === "" ? domain : `${name}.${domain}`;
+}
+/** `dns-record:<fqdn>:<type>` */
+function dnsResourceKey(fqdn, type) {
+	return `${DNS_RECORD_RESOURCE}:${fqdn.toLowerCase()}:${type.toUpperCase()}`;
+}
+/** The resource record a written DNS record is kept as. */
+function dnsRecordResource(record) {
+	const fqdn = dnsRecordFqdn(record.domain, record.name).toLowerCase();
+	const type = record.type.toUpperCase();
+	const data = {
+		domain: record.domain,
+		name: record.name,
+		value: record.value,
+		ttl: record.ttl,
+		...record.provider ? { provider: record.provider } : {}
+	};
+	return {
+		key: dnsResourceKey(fqdn, type),
+		type: DNS_RECORD_RESOURCE,
+		id: `${fqdn} ${type}`,
+		status: "ready",
+		data
+	};
+}
+/** Records that gkm wrote `record` — or updates the value it holds. */
+async function recordDnsResource(journal, record) {
+	const { key, type, id, data } = dnsRecordResource(record);
+	await journal.ready({
+		key,
+		type,
+		...data ? { data } : {}
+	}, id);
+}
+/** Forgets a DNS record gkm deleted. */
+async function forgetDnsResource(journal, record) {
+	await journal.forget(dnsResourceKey(dnsRecordFqdn(record.domain, record.name), record.type));
+}
+/**
+* The changes a DNS step made, kept: what it created, updated or wrote is
+* recorded, what it deleted is forgotten. A record it found already right is
+* recorded only if gkm wrote it before; one it left to a person is not.
+*/
+async function recordDnsChanges(journal, changes, providerOf) {
+	for (const change of changes) {
+		if (change.action === "delete") {
+			await forgetDnsResource(journal, change);
+			continue;
+		}
+		const written = change.action === "create" || change.action === "update" || change.action === "write";
+		const known = change.action === "unchanged" && journal.record(dnsResourceKey(dnsRecordFqdn(change.domain, change.name), change.type)) !== void 0;
+		if (!written && !known || change.value === void 0) continue;
+		const provider = providerOf(change.domain);
+		await recordDnsResource(journal, {
+			domain: change.domain,
+			name: change.name,
+			type: change.type,
+			value: change.value,
+			ttl: change.ttl ?? 0,
+			...provider ? { provider } : {}
+		});
+	}
+}
+/** Every DNS record gkm wrote for the stage, from its resource records. */
+function dnsResources(resources) {
+	return Object.values(resources).filter((record) => record.type === DNS_RECORD_RESOURCE).map((record) => {
+		const data = record.data ?? {};
+		const [fqdn = "", type = ""] = (record.id ?? "").split(" ");
+		return {
+			...data,
+			type,
+			fqdn
+		};
+	}).sort((a, b) => a.fqdn.localeCompare(b.fqdn) || a.type.localeCompare(b.type));
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -6953,29 +7074,7 @@ function reportDevServices(ctx, uses) {
 function isStateProvider(value) {
 	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
 }
-//#endregion
-//#region src/deploy/StateStore.ts
-/**
-* Deploy state store.
-*
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
-*
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
-*/
-var StateLocked = class extends Error {
+var StateLocked = class extends GkmError {
 	stage;
 	holder;
 	location;
@@ -6988,7 +7087,7 @@ var StateLocked = class extends Error {
 		this.name = "StateLocked";
 	}
 };
-var StateVersionConflict = class extends Error {
+var StateVersionConflict = class extends GkmError {
 	stage;
 	expectedVersion;
 	actualVersion;
@@ -7000,7 +7099,7 @@ var StateVersionConflict = class extends Error {
 		this.name = "StateVersionConflict";
 	}
 };
-var StageStateMissing = class extends Error {
+var StageStateMissing = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
@@ -7008,7 +7107,7 @@ var StageStateMissing = class extends Error {
 		this.name = "StageStateMissing";
 	}
 };
-var StateUnreadable = class extends Error {
+var StateUnreadable = class extends GkmError {
 	stage;
 	location;
 	constructor(stage, location, cause) {
@@ -7018,11 +7117,11 @@ var StateUnreadable = class extends Error {
 		this.name = "StateUnreadable";
 	}
 };
-var StateSchemaTooNew = class extends Error {
+var StateSchemaTooNew = class extends GkmError {
 	stage;
 	schemaVersion;
 	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (3). Upgrade @geekmidas/cli to the version that wrote it.`);
 		this.stage = stage;
 		this.schemaVersion = schemaVersion;
 		this.name = "StateSchemaTooNew";
@@ -7033,7 +7132,7 @@ var StateSchemaTooNew = class extends Error {
 * in for a store, so a deploy that cannot be protected from a concurrent one
 * says so.
 */
-var StateStoreWithoutLocking = class extends Error {
+var StateStoreWithoutLocking = class extends GkmError {
 	provider;
 	constructor(provider) {
 		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
@@ -7041,7 +7140,7 @@ var StateStoreWithoutLocking = class extends Error {
 		this.name = "StateStoreWithoutLocking";
 	}
 };
-var StateStoreNeedsWorkspaceName = class extends Error {
+var StateStoreNeedsWorkspaceName = class extends GkmError {
 	provider;
 	constructor(provider) {
 		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
@@ -7049,7 +7148,7 @@ var StateStoreNeedsWorkspaceName = class extends Error {
 		this.name = "StateStoreNeedsWorkspaceName";
 	}
 };
-var UnknownStateProvider = class extends Error {
+var UnknownStateProvider = class extends GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
@@ -7057,8 +7156,24 @@ var UnknownStateProvider = class extends Error {
 		this.name = "UnknownStateProvider";
 	}
 };
+/**
+* A deploy, setup or rollback of a stage in CI, with the stage's state kept on
+* the runner — which is discarded when the job ends.
+*/
+var LocalStateInCi = class extends GkmError {
+	stage;
+	operation;
+	region;
+	constructor(stage, operation, region) {
+		super(`\`gkm ${operation}\` would keep stage '${stage}'s deploy state in .gkm/ on this CI runner, and the runner is discarded when the job ends: the next run would start without it — no releases to roll back to, no record of what was created. Keep the state in AWS — in gkm.config.ts:\n\n  state: { provider: 'ssm', region: '${region}' },\n\nthen move the state you already have, from the machine that holds it:\n\n  gkm state:push --stage ${stage}\n`);
+		this.stage = stage;
+		this.operation = operation;
+		this.region = region;
+		this.name = "LocalStateInCi";
+	}
+};
 /** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
+var StateStoreBusy = class extends GkmError {
 	stage;
 	location;
 	constructor(stage, location) {
@@ -7085,6 +7200,10 @@ function decodeDocument(stage, body, location) {
 		schemaVersion: 2,
 		document: parsed
 	};
+	if (schemaVersion === 3) return {
+		schemaVersion: 3,
+		document: parsed
+	};
 	throw new StateSchemaTooNew(stage, schemaVersion);
 }
 function encodeDocument(document) {
@@ -7124,6 +7243,79 @@ function migrateV1(stage, state) {
 		updatedAt: now
 	};
 }
+const isEmpty = (value) => !value || Object.keys(value).length === 0;
+/**
+* Whether a v2 state in the Dokploy shape was written by the compose target.
+*
+* Before v3 every target wrote the Dokploy shape, and compose filled none of
+* its Dokploy fields. So the rule is the shape's content, not the target the
+* workspace names now: a state whose every Dokploy-only field is empty — no
+* project or environment id, no application or service ids, no credentials,
+* generated secrets, backups or registry — holds nothing only Dokploy could
+* use, and reading it as compose loses nothing. One with any of them was
+* written by Dokploy and is kept exactly as it is.
+*
+* The configured target is not used: a document decodes the same wherever it
+* is read (`state:show`, `state:push`) without a workspace, a stage can be
+* moved between targets, and `--target` can override a run.
+*/
+function writtenByCompose(state) {
+	return !state.projectId && !state.environmentId && isEmpty(state.applications) && !state.services?.postgresId && !state.services?.redisId && isEmpty(state.appCredentials) && isEmpty(state.generatedSecrets) && !state.backups && !state.registryId;
+}
+/**
+* A v2 state and its records as v3 keeps them. A compose-written state
+* becomes the compose shape: its `dnsRecords` become `dns-record` resources,
+* and `dnsVerified` and the empty Dokploy fields go — the DNS check is made
+* on every deploy. A Dokploy state is returned as it is.
+*/
+function upgradeV2State(state, resources) {
+	if (!writtenByCompose(state)) return {
+		state,
+		resources
+	};
+	const compose = {
+		provider: "compose",
+		stage: state.stage,
+		lastDeployedAt: state.lastDeployedAt,
+		...state.identity ? { identity: state.identity } : {},
+		...state.releases ? { releases: state.releases } : {}
+	};
+	const upgraded = { ...resources };
+	for (const record of Object.values(state.dnsRecords ?? {})) {
+		const resource = migratedDnsResource(record);
+		upgraded[resource.key] = resource;
+	}
+	return {
+		state: compose,
+		resources: upgraded
+	};
+}
+/** A v2 `dnsRecords` entry as the `dns-record` resource v3 keeps. */
+function migratedDnsResource(record) {
+	return {
+		...dnsRecordResource({
+			domain: record.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		}),
+		updatedAt: record.createdAt
+	};
+}
+/** A v2 document as v3 — not written until the next write. */
+function migrateV2(document) {
+	const { state, resources } = upgradeV2State(document.state, document.resources);
+	return {
+		schemaVersion: 3,
+		stage: document.stage,
+		serial: document.serial,
+		state,
+		resources,
+		updatedAt: document.updatedAt,
+		history: []
+	};
+}
 function newLockHolder(options) {
 	let owner = "unknown";
 	try {
@@ -7142,14 +7334,33 @@ function contentVersion(body) {
 	return createHash("sha256").update(body).digest("hex").slice(0, 16);
 }
 /**
+* `history` with this write at its head. A run makes many writes — one per
+* resource it journals — so a run is one entry: a write by the run that
+* wrote the newest entry (the same lock) replaces it, and any other is
+* added. Without a lock, each write is its own entry.
+*/
+function appendHistory(history, entry, sameRun) {
+	return [entry, ...sameRun ? history.slice(1) : history].slice(0, 20);
+}
+/**
 * A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
+* stage, and create a lock object only if it does not exist. Migration,
+* resource records and history are the same for every such backend, so they
+* live here.
 */
 var DocumentStateStore = class {
+	/** The lock this store holds for each stage — what its writes are for. */
+	held = /* @__PURE__ */ new Map();
+	/** Per stage, the lock whose run wrote the newest history entry. */
+	logged = /* @__PURE__ */ new Map();
+	/** Who this store writes as. */
+	actor() {
+		return currentActor();
+	}
 	async lock(stage, options) {
 		const holder = newLockHolder(options);
 		await this.createLock(stage, holder);
+		this.held.set(stage, holder);
 		let released = false;
 		return {
 			stage,
@@ -7157,6 +7368,7 @@ var DocumentStateStore = class {
 			release: async () => {
 				if (released) return;
 				released = true;
+				if (this.held.get(stage)?.id === holder.id) this.held.delete(stage);
 				await this.removeLock(stage, holder);
 			}
 		};
@@ -7172,19 +7384,21 @@ var DocumentStateStore = class {
 		return {
 			state: current.document.state,
 			resources: current.document.resources,
+			history: current.document.history,
 			version: current.version
 		};
 	}
 	async write(stage, state, options) {
 		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
+			const document = this.stamp(stage, {
+				schemaVersion: 3,
 				stage,
 				serial: 1,
 				state,
 				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				history: []
+			});
 			return this.writeRaw(stage, encodeDocument(document), null);
 		}
 		return this.mutate(stage, options.expectedVersion, (document) => ({
@@ -7199,7 +7413,8 @@ var DocumentStateStore = class {
 				...document.resources,
 				[record.key]: {
 					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					updatedBy: this.actor()
 				}
 			}
 		}));
@@ -7213,6 +7428,25 @@ var DocumentStateStore = class {
 			};
 		});
 	}
+	/** `document` as this write leaves it: who wrote it, in its history. */
+	stamp(stage, document) {
+		const by = this.actor();
+		const holder = this.held.get(stage);
+		const operation = holder?.operation ?? "write";
+		const history = document.history ?? [];
+		const sameRun = holder !== void 0 && this.logged.get(stage) === holder.id && history[0]?.operation === operation;
+		if (holder) this.logged.set(stage, holder.id);
+		return {
+			...document,
+			updatedBy: by,
+			history: appendHistory(history, {
+				serial: document.serial,
+				at: document.updatedAt,
+				by,
+				operation
+			}, sameRun)
+		};
+	}
 	async mutate(stage, expectedVersion, change) {
 		const current = await this.readDocument(stage);
 		if (!current) {
@@ -7221,25 +7455,31 @@ var DocumentStateStore = class {
 		}
 		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
 		const next = change(current.document);
+		next.schemaVersion = 3;
 		next.serial = current.document.serial + 1;
 		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
+		return this.writeRaw(stage, encodeDocument(this.stamp(stage, next)), current.version);
 	}
 	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
+	* Reads the stage's document as v3. A v1 document is migrated in place on
+	* the way — itself a conditional write: if another run migrated (or wrote)
+	* first, its result is read instead. A v2 document is upgraded in memory
+	* and written as v3 by the next write.
 	*/
 	async readDocument(stage, attempt = 0) {
 		const raw = await this.readRaw(stage);
 		if (!raw) return null;
 		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
+		if (decoded.schemaVersion === 3) return {
 			document: decoded.document,
 			version: raw.version
 		};
+		if (decoded.schemaVersion === 2) return {
+			document: migrateV2(decoded.document),
+			version: raw.version
+		};
 		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
+		const document = this.stamp(stage, migrateV2(migrateV1(stage, decoded.state)));
 		try {
 			return {
 				document,
@@ -7251,6 +7491,22 @@ var DocumentStateStore = class {
 		}
 	}
 };
+/** Whether `config` keeps state on this machine — `local`, or none given. */
+function isLocalState(config) {
+	return !config || config.provider === "local";
+}
+/**
+* Refuses, with `LocalStateInCi`, a run that would write a deployed stage's
+* state to a CI runner's disk — the local stage, which runs on the runner
+* itself, is exempt. Local use is untouched. The region the message
+* suggests is the secrets store's, when the workspace keeps them in AWS.
+*/
+function assertStateOutlivesRun(workspace, stage, operation, env = process.env) {
+	if (stage === workspace.stages?.local) return;
+	if (!isCi(env) || !isLocalState(workspace.state)) return;
+	const store = workspace.secrets?.store;
+	throw new LocalStateInCi(stage, operation, typeof store === "object" && store && typeof store.region === "string" ? store.region : "<region>");
+}
 function isStateStore(value) {
 	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
 }
@@ -7267,17 +7523,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-CU-O0SBp.mjs").then((n) => n.n);
+		const { LocalStateStore } = await import("./LocalStateStore-D40_SDmJ.mjs").then((n) => n.n);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-ZkdmiUFZ.mjs");
+		const { LegacyStateStore } = await import("./LegacyStateStore-CtwO7fwy.mjs");
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-CsOS0W1y.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-k_Ew7TWx.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7287,7 +7543,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-bwxcI_wQ.mjs");
+		const { S3StateStore } = await import("./S3StateStore-BzS0IeSt.mjs");
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7322,7 +7578,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-BI6J7oJr.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-1mqD6aG8.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -7335,7 +7591,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-DSStJVAv.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-Mi3vptSR.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7346,7 +7602,7 @@ async function createDnsProvider(options) {
 * scoped to updates only. What reads them falls back to writing every record,
 * which is idempotent, without a diff.
 */
-var DnsRecordsUnreadable = class extends Error {
+var DnsRecordsUnreadable = class extends GkmError {
 	provider;
 	domain;
 	reason;
@@ -7368,7 +7624,7 @@ var DnsProviderNotImplemented = class extends Error {
 	}
 };
 /** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
-var DnsProviderUnknown = class extends Error {
+var DnsProviderUnknown = class extends GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
@@ -7392,6 +7648,31 @@ function createEmptyState(stage, projectId, environmentId) {
 		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
+/** A new compose stage's state. */
+function createComposeState(stage) {
+	return {
+		provider: "compose",
+		stage,
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* `state` as the Dokploy target keeps it. A stage whose state another target
+* wrote — one moved from compose to Dokploy — keeps its core (releases,
+* identity) and starts with no Dokploy ids, as a first deploy would.
+*/
+function asDokployState(state) {
+	if (state.provider === "dokploy") return state;
+	const { provider: _provider, ...core } = state;
+	return {
+		...core,
+		provider: "dokploy",
+		projectId: "",
+		environmentId: "",
+		applications: {},
+		services: {}
+	};
+}
 /**
 * Set application ID in state (mutates state)
 */
@@ -7411,12 +7692,13 @@ function restorable(history, index, current) {
 * `current`, and what was current becomes `previous`. Releasing what already
 * runs — a redeploy of the same digest — changes nothing.
 */
-function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+function recordRelease(state, appName, image, by, releasedAt = /* @__PURE__ */ new Date()) {
 	const releases = state.releases?.[appName];
 	if (releases && sameImage(releases.current, image)) return;
 	const entry = {
 		...image,
-		releasedAt: releasedAt.toISOString()
+		releasedAt: releasedAt.toISOString(),
+		releasedBy: by
 	};
 	const history = [entry, ...releases?.history ?? []].slice(0, 10);
 	const previous = releases?.current;
@@ -7864,6 +8146,422 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends GkmError {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends GkmError {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !isIPv6(ipv6)) throw new ServerAddressInvalid(stage, SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!isIPv4(ipv4)) throw new ServerAddressInvalid(stage, SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await lookup(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends GkmError {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -7882,7 +8580,7 @@ const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPON
 /** Docker refuses a repository name longer than this. */
 const MAX_NAME_LENGTH = 255;
 /** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends Error {
+var ImageRefInvalid = class extends GkmError {
 	ref;
 	constructor(ref) {
 		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
@@ -7918,7 +8616,7 @@ var DockerPushFailed = class extends Error {
 	}
 };
 /** `gkm docker --push` was asked for with nowhere to push to. */
-var PushNeedsRegistry = class extends Error {
+var PushNeedsRegistry = class extends GkmError {
 	imageName;
 	constructor(imageName) {
 		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
@@ -8185,7 +8883,7 @@ function constructsOf$1(manifest, kind) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
 }
 /** A stage that names `false` for a kind, and declares constructs of it. */
-var StageProviderDisabled = class extends Error {
+var StageProviderDisabled = class extends GkmError {
 	kind;
 	stage;
 	ids;
@@ -8256,14 +8954,9 @@ var DeployJournal = class DeployJournal {
 		this.version = version;
 		this.existed = existed;
 	}
-	/**
-	* The stage's journal — its stored state, or `initial` written as the
-	* stage's first state, so there is somewhere to record the very first
-	* resource before it is created.
-	*/
-	static async open(store, stage, initial) {
+	static async open(store, stage, initial, adopt = (stored) => stored) {
 		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
 		const state = initial();
 		const version = await store.write(stage, state, { expectedVersion: null });
 		return new DeployJournal(store, stage, state, {}, version, false);
@@ -8282,10 +8975,13 @@ var DeployJournal = class DeployJournal {
 			status: "pending"
 		});
 	}
-	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
 	async ready(entry, id) {
 		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id) return;
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
 		await this.put({
 			...entry,
 			status: "ready",
@@ -8330,6 +9026,17 @@ var DeployJournal = class DeployJournal {
 			...staleId ? { staleId } : {}
 		};
 	}
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
 	/** Writes the stage's state, keeping its resource records. */
 	async save() {
 		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -8347,6 +9054,138 @@ var DeployJournal = class DeployJournal {
 	}
 };
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
+	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await import("./secrets-DbPmAS4k.mjs").then((n) => n.n);
+	const { composeStack } = await import("./stack-Co4uZkAo.mjs").then((n) => n.c);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	return stackHosts(composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	}));
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const server = serverAddress(stage, (await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		const changes = await applyStackDns(plan, {
+			...options.dryRun ? { dryRun: true } : {},
+			log,
+			credentials: {
+				env: options.env ?? process.env,
+				...options.home ? { home: options.home } : {},
+				log
+			},
+			...options.providerFor ? { providerFor: options.providerFor } : {}
+		});
+		if (options.journal && !options.dryRun) {
+			const providers = new Map(plan.domains.map((domain) => [domain.domain, domain.provider]));
+			await recordDnsChanges(options.journal, changes, (domain) => providers.get(domain));
+		}
+		return {
+			mode: "records",
+			hosts,
+			changes
+		};
+	} catch (error) {
+		if (error instanceof MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/providers/aws.ts
 /**
 * The AWS account a provider provisions in — the stage's, found the way the
@@ -8421,7 +9260,7 @@ async function awsClientConfig(credential, region) {
 }
 const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 /** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends Error {
+var InvalidBucketName = class extends GkmError {
 	bucket;
 	reason;
 	constructor(bucket, reason) {
@@ -9318,7 +10157,7 @@ async function provisionStage(options) {
 	});
 	const lock = dryRun ? void 0 : await stateStore.lock(stage, { operation: "provision" });
 	try {
-		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => createEmptyState(stage, "", "")));
+		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
 		const writeSecrets = async (values) => {
 			if (dryRun) return;
 			const stored = await secretsStore.read(stage) ?? initStageSecrets(stage);
@@ -9423,7 +10262,7 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 * `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
 * generated. Set by hand wins over derived, so the app would be handed it.
 */
-var StaleStageSecrets = class extends Error {
+var StaleStageSecrets = class extends GkmError {
 	stage;
 	stale;
 	constructor(stage, stale) {
@@ -9533,6 +10372,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { externalServices as $, LOCAL_LOGS_EMAIL as $n, isImageBuild as $t, setApplicationId as A, prepareEntryCredentials as An, applyPolicies as At, StateStoreWithoutLocking as B, applicationName as Bn, appEnvKeys as Bt, orchestrateDns as C, createCredentialsPreload as Cn, redisService as Ct, getGeneratedSecret as D, loadEnvFiles as Dn, LOCAL_CA_PATH as Dt, getBackupState as E, isPortAvailable as En, withRedisPassword as Et, createDnsProvider as F, FileSecretsStore as Fn, quoteIdentifier as Ft, AllowDevServicesTakesNoValue as G, markerOf as Gn, localRolePassword as Gt, contentVersion as H, imageName as Hn, networkEnv as Ht, DocumentStateStore as I, getKeyPath as In, LEGACY_LOCAL_LOGIN as It, ExternalServicesNotConfigured as J, initStageSecrets as Jn, TURBO_VERSION as Jt, DEV_SERVICES as K, ownershipMarker as Kn, composeBuildPaths as Kt, StageStateMissing as L, keystoreProject as Ln, ensurePostgresLogin as Lt, setGeneratedSecret as M, secretsStoreFor as Mn, bucketPolicies as Mt, setPostgresBackupId as N, storeFromConfig as Nn, postgresDatabaseNames as Nt, recordRelease as O, loadPortState as On, forgetState as Ot, DnsRecordsUnreadable as P, store_exports as Pn, postgresStatements as Pt, devServicesUsed as Q, withCustomSecret as Qn, imageBuildCredentials as Qt, StateLocked as R, projectKey as Rn, bucketClient as Rt, normalizeDnsConfig as S, primaryPortKey as Sn, STACK_CACHE as St, createEmptyState as T, findAvailablePort as Tn, stackRedis as Tt, createStateStore as U, imageRef as Un, workerEnvKeys as Ut, StateVersionConflict as V, deployIdentity as Vn, dockerfileOf as Vt, newLockHolder as W, isOwnedBy as Wn, envFor as Wt, assertDevServicesFlag as X, storage_exports as Xn, detectPackageManager as Xt, STORAGE_KEY_PAIR as Y, maskPassword as Yn, WORKER_PORT as Yt, assertExternalServices as Z, toEmbeddableSecrets as Zn, findBuildRoot as Zt, workerDockerfile as _, DEFAULT_IMAGES as _n, loadLocalCredentials as _t, provisionStage as a, composeFor as an, NoDomainForStage as ar, WorkerGenerator as at, extractSubdomain as b, portKeys as bn, withGeneratedSecrets as bt, StageProviderDisabled as c, planFor as cn, QueueGenerator as ct, stageProviderNotes as d, appTelemetry as dn, backendsOf as dt, cacheBackendFor as en, LOGS_SERVICE as er, manifestServiceDeclarations as et, DockerBuildFailed as f, isTelemetryKey as fn, constructGlobs as ft, ensureDockerignore as g, usesTelemetry as gn, LOCAL_RABBITMQ_USER as gt, dockerCommand as h, telemetryOf as hn, workspace_exports as ht, assertNoStaleSecrets as i, CLUSTER_DATABASE as in, withLogsPassword as ir, workerUnits as it, setBackupState as j, isRemoteStore as jn, applyPostgres as jt, recordRollback as k, loadSecretsForApp as kn, applyBuckets as kt, assertStageProvidersEnabled as l, resourceName as ln, CronGenerator as lt, appDockerfile as m, surfaceClientTraced as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, providerOf as nn, logsService as nr, requiredStageKeys as nt, verifyStageProviders as o, EMULATOR_ACCESS_KEY_ID as on, isMainFrontendApp as or, workerBundleName as ot, DockerPushFailed as p, scopeTelemetryEnv as pn, derivedContainers as pt, DevServicesNeedServerTarget as q, projectName as qn, imageLayout as qt, reportPlannedSeeds as r, storageBackendFor as rn, stackLogs as rr, suppliedOnly as rt, DeployJournal as s, TELEMETRY_CONTAINER as sn, resolveHost as sr, workerEntryDir as st, DeploySeedsFailed as t, eventsBackendFor as tn, logsAccess as tr, reportDevServices as tt, provisionCommand as u, hostFor as un, FAKE_ENV as ut, workerDockerfileOf as v, describeServices as vn, postgresSuperuser as vt, verifyDnsRecords as w, createEntryWrapper as wn, runsRedis as wt, findRootDomain as x, portsOf as xn, REDIS_SERVICE as xt, validateImageRef as y, fakeKey as yn, readLocalCredentials as yt, StateStoreBusy as z, readKey as zn, pgClient as zt };
+export { contentVersion as $, projectKey as $n, bucketClient as $t, orchestrateDns as A, telemetryOf as An, workspace_exports as At, setBackupState as B, findAvailablePort as Bn, stackRedis as Bt, HostNotPointingAtServer as C, planFor as Cn, QueueGenerator as Ct, serverAddressHint as D, isTelemetryKey as Dn, constructGlobs as Dt, requiredServerAddress as E, appTelemetry as En, backendsOf as Et, getBackupState as F, portKeys as Fn, withGeneratedSecrets as Ft, LocalStateInCi as G, prepareEntryCredentials as Gn, applyPolicies as Gt, setPostgresBackupId as H, loadEnvFiles as Hn, LOCAL_CA_PATH as Ht, getGeneratedSecret as I, portsOf as In, REDIS_SERVICE as It, StateStoreBusy as J, storeFromConfig as Jn, postgresDatabaseNames as Jt, StageStateMissing as K, isRemoteStore as Kn, applyPostgres as Kt, recordRelease as L, primaryPortKey as Ln, STACK_CACHE as Lt, asDokployState as M, DEFAULT_IMAGES as Mn, loadLocalCredentials as Mt, createComposeState as N, describeServices as Nn, postgresSuperuser as Nt, stackHosts as O, scopeTelemetryEnv as On, derivedContainers as Ot, createEmptyState as P, fakeKey as Pn, readLocalCredentials as Pt, assertStateOutlivesRun as Q, keystoreProject as Qn, ensurePostgresLogin as Qt, recordRollback as R, createCredentialsPreload as Rn, redisService as Rt, validateImageRef as S, TELEMETRY_CONTAINER as Sn, resolveHost as Sr, workerEntryDir as St, isLocalHost as T, hostFor as Tn, FAKE_ENV as Tt, DnsRecordsUnreadable as U, loadPortState as Un, forgetState as Ut, setGeneratedSecret as V, isPortAvailable as Vn, withRedisPassword as Vt, DocumentStateStore as W, loadSecretsForApp as Wn, applyBuckets as Wt, StateVersionConflict as X, FileSecretsStore as Xn, quoteIdentifier as Xt, StateStoreWithoutLocking as Y, store_exports as Yn, postgresStatements as Yt, appendHistory as Z, getKeyPath as Zn, LEGACY_LOCAL_LOGIN as Zt, appDockerfile as _, providerOf as _n, logsService as _r, requiredStageKeys as _t, provisionStage as a, envFor as an, isOwnedBy as ar, describeActor as at, workerDockerfile as b, composeFor as bn, NoDomainForStage as br, WorkerGenerator as bt, deploysWithCompose as c, imageLayout as cn, projectName as cr, DevServicesNeedServerTarget as ct, StageProviderDisabled as d, detectPackageManager as dn, storage_exports as dr, assertDevServicesFlag as dt, pgClient as en, readKey as er, createStateStore as et, assertStageProvidersEnabled as f, findBuildRoot as fn, toEmbeddableSecrets as fr, assertExternalServices as ft, DockerPushFailed as g, eventsBackendFor as gn, logsAccess as gr, reportDevServices as gt, DockerBuildFailed as h, cacheBackendFor as hn, LOGS_SERVICE as hr, manifestServiceDeclarations as ht, assertNoStaleSecrets as i, workerEnvKeys as in, imageRef as ir, currentActor as it, verifyDnsRecords as j, usesTelemetry as jn, LOCAL_RABBITMQ_USER as jt, systemLookup as k, surfaceClientTraced as kn, reconcileWorkspace as kt, provisionStageDns as l, TURBO_VERSION as ln, initStageSecrets as lr, ExternalServicesNotConfigured as lt, stageProviderNotes as m, isImageBuild as mn, LOCAL_LOGS_EMAIL as mr, externalServices as mt, reportDatabaseRuns as n, dockerfileOf as nn, deployIdentity as nr, upgradeV2State as nt, verifyStageProviders as o, localRolePassword as on, markerOf as or, AllowDevServicesTakesNoValue as ot, provisionCommand as p, imageBuildCredentials as pn, withCustomSecret as pr, devServicesUsed as pt, StateLocked as q, secretsStoreFor as qn, bucketPolicies as qt, reportPlannedSeeds as r, networkEnv as rn, imageName as rr, dnsResources as rt, assertStageServer as s, composeBuildPaths as sn, ownershipMarker as sr, DEV_SERVICES as st, DeploySeedsFailed as t, appEnvKeys as tn, applicationName as tr, newLockHolder as tt, DeployJournal as u, WORKER_PORT as un, maskPassword as ur, STORAGE_KEY_PAIR as ut, dockerCommand as v, storageBackendFor as vn, stackLogs as vr, suppliedOnly as vt, checkStackDns as w, resourceName as wn, CronGenerator as wt, workerDockerfileOf as x, EMULATOR_ACCESS_KEY_ID as xn, isMainFrontendApp as xr, workerBundleName as xt, ensureDockerignore as y, CLUSTER_DATABASE as yn, withLogsPassword as yr, workerUnits as yt, setApplicationId as z, createEntryWrapper as zn, runsRedis as zt };
 
-//# sourceMappingURL=seeds-odfgSCmu.mjs.map
+//# sourceMappingURL=seeds-BSL55F6q.mjs.map