@geekmidas/cli 10.0.0-alpha.91 → 10.0.0-alpha.93

package/dist/{seeds-CkIPFGNO.cjs → seeds-c-ByX9je.cjs}

@@ -1,12 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-BKfIugu2.cjs");
-const require_discover = require("./discover-D1It5r_h.cjs");
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_credentials = require("./credentials-QBu7VgaQ.cjs");
+const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CwW3Gkru.cjs");
+const require_workspace = require("./workspace-CHOB2Xg3.cjs");
 const require_config = require("./config.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
-const require_resolve = require("./resolve-Cns0v6dN.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
+const require_resolve = require("./resolve-g8htuR80.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -66,7 +67,7 @@ function rootSite(sites) {
 	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
 }
 /** Several sites could hold the base domain, and none of them says it does. */
-var AmbiguousRootSite = class extends Error {
+var AmbiguousRootSite = class extends require_errors.GkmError {
 	sites;
 	tooMany;
 	constructor(sites, tooMany = false) {
@@ -79,7 +80,7 @@ var AmbiguousRootSite = class extends Error {
 //#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `domains` gives no domain. */
-var NoDomainForStage = class extends Error {
+var NoDomainForStage = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`No domain for stage "${stage}". Add it to gkm.config.ts: domains: { ${stage}: 'example.com' }.`);
@@ -170,7 +171,7 @@ const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
 */
 const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
 /** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
+var LogsPasswordWeak = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
@@ -179,7 +180,7 @@ var LogsPasswordWeak = class extends Error {
 	}
 };
 /** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
+var LogsPasswordMissing = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -436,7 +437,7 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 * `DeployIdentity` is what a deploy names and claims its resources by instead.
 */
 /** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends Error {
+var DeployNamespaceInvalid = class extends require_errors.GkmError {
 	namespace;
 	constructor(namespace) {
 		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
@@ -445,7 +446,7 @@ var DeployNamespaceInvalid = class extends Error {
 	}
 };
 /** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends Error {
+var DeployProjectNameInvalid = class extends require_errors.GkmError {
 	workspaceName;
 	constructor(workspaceName) {
 		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
@@ -551,7 +552,7 @@ function applicationName(identity, app) {
 /** Key length for AES-256 encryption */
 const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
-var KeystoreProjectInvalid = class extends Error {
+var KeystoreProjectInvalid = class extends require_errors.GkmError {
 	key;
 	constructor(key) {
 		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
@@ -560,7 +561,7 @@ var KeystoreProjectInvalid = class extends Error {
 	}
 };
 /** A stage has no key, here or at the place keys used to be kept. */
-var KeyNotFound = class extends Error {
+var KeyNotFound = class extends require_errors.GkmError {
 	stage;
 	project;
 	path;
@@ -757,7 +758,7 @@ var FileSecretsStore = class {
 	}
 };
 /** A stage's secrets file exists, and the key that opens it does not. */
-var MissingSecretsKey = class extends Error {
+var MissingSecretsKey = class extends require_errors.GkmError {
 	stage;
 	project;
 	path;
@@ -832,7 +833,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "ssm": {
-			const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-BTawF0F-.cjs")).then((n) => n.aws_exports);
+			const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-BTReGjpY.cjs")).then((n) => n.aws_exports);
 			return new AwsSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -841,7 +842,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 		}
 		case "secrets-manager": {
 			const { kmsKeyId } = config;
-			const { SecretsManagerSecretsStore } = await Promise.resolve().then(() => require("./secretsManager-DcMlHnRC.cjs")).then((n) => n.secretsManager_exports);
+			const { SecretsManagerSecretsStore } = await Promise.resolve().then(() => require("./secretsManager-Cwwgs81g.cjs")).then((n) => n.secretsManager_exports);
 			return new SecretsManagerSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -1845,7 +1846,7 @@ function planFor(manifest, stage, order, options = {}) {
 * code either way — declare a database, or select a backend that brings its own
 * broker.
 */
-var CacheNeedsDatabase = class extends Error {
+var CacheNeedsDatabase = class extends require_errors.GkmError {
 	ids;
 	constructor(ids) {
 		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
@@ -1864,7 +1865,7 @@ var CacheNeedsDatabase = class extends Error {
 * `orders.cache('Sessions')` names the database, which is a fact about the
 * application rather than a deployment choice.
 */
-var CacheIsAmbiguous = class extends Error {
+var CacheIsAmbiguous = class extends require_errors.GkmError {
 	ids;
 	databases;
 	constructor(ids, databases) {
@@ -1874,7 +1875,7 @@ var CacheIsAmbiguous = class extends Error {
 		this.name = "CacheIsAmbiguous";
 	}
 };
-var PgBossNeedsDatabase = class extends Error {
+var PgBossNeedsDatabase = class extends require_errors.GkmError {
 	ids;
 	constructor(ids) {
 		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
@@ -3130,7 +3131,7 @@ CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile
 * prune` to one app's slice. Nothing is built on the host.
 */
 /** A workspace of packages with no turbo.json, which every image prunes with. */
-var MonorepoNeedsTurbo = class extends Error {
+var MonorepoNeedsTurbo = class extends require_errors.GkmError {
 	buildRoot;
 	constructor(buildRoot) {
 		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
@@ -3669,7 +3670,7 @@ function schemaOf(resource, plan) {
 * On SNS each topic and queue is its own address, so there is no project-wide
 * one to hand out — a cron's schedule store, say, cannot live there.
 */
-var UnprovisionedEventsBackend = class extends Error {
+var UnprovisionedEventsBackend = class extends require_errors.GkmError {
 	backend;
 	constructor(backend) {
 		super(`'${backend}' has no single broker address: each topic and queue is addressed by its own ARN. Something asked for one without naming the topic or queue.`);
@@ -4302,7 +4303,7 @@ const LEGACY_LOCAL_LOGIN = Object.freeze({
 	password: "geekmidas"
 });
 /** No login this workspace knows opens its Postgres. */
-var PostgresLoginRefused = class extends Error {
+var PostgresLoginRefused = class extends require_errors.GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4313,7 +4314,7 @@ var PostgresLoginRefused = class extends Error {
 	}
 };
 /** No login this workspace knows opens its MinIO. */
-var MinioLoginRefused = class extends Error {
+var MinioLoginRefused = class extends require_errors.GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4660,7 +4661,7 @@ async function heldElsewhere(kept, keys, observed, probe, ours) {
 	return held;
 }
 /** The window was exhausted. */
-var NoPortAvailable = class extends Error {
+var NoPortAvailable = class extends require_errors.GkmError {
 	/** Where the search started. */
 	from;
 	/** The window searched, so the caller can report what was full. */
@@ -5406,7 +5407,7 @@ const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
 /** Redis's own count of logical databases, before `--databases` raises it. */
 const REDIS_DATABASES = 16;
 /** A deployed stage that runs the stack's Redis and has no password yet. */
-var RedisPasswordMissing = class extends Error {
+var RedisPasswordMissing = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -5640,7 +5641,7 @@ function localCredentialsPath(project) {
 	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
-var LocalCredentialsKeyMissing = class extends Error {
+var LocalCredentialsKeyMissing = class extends require_errors.GkmError {
 	path;
 	stage;
 	constructor(path, stage) {
@@ -5651,7 +5652,7 @@ var LocalCredentialsKeyMissing = class extends Error {
 	}
 };
 /** Another gkm held the logins file's lock for longer than any write takes. */
-var LocalCredentialsLocked = class extends Error {
+var LocalCredentialsLocked = class extends require_errors.GkmError {
 	lock;
 	constructor(lock) {
 		super(`Another gkm has been writing the local logins for over ${LOCK_TIMEOUT_MS / 1e3}s. If none is running, remove ${lock} and run the command again.`);
@@ -6351,7 +6352,7 @@ export async function stopQueues(): Promise<void> {
 * reached by building server images for a project that deploys to AWS — where
 * a subscriber is a Lambda instead.
 */
-var WorkerSubscribersNeedPush = class extends Error {
+var WorkerSubscribersNeedPush = class extends require_errors.GkmError {
 	worker;
 	subscribers;
 	constructor(worker, subscribers) {
@@ -6582,7 +6583,7 @@ logger.info({ port }, 'Worker started');
 //#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
-var WorkerHasNoApp = class extends Error {
+var WorkerHasNoApp = class extends require_errors.GkmError {
 	worker;
 	constructor(worker) {
 		super(`The worker '${worker}' has crons, queues or subscribers, and the workspace has no backend app that builds a server to carry its entry. Declare a RestApi whose app holds the worker's code.`);
@@ -6591,7 +6592,7 @@ var WorkerHasNoApp = class extends Error {
 	}
 };
 /** A worker whose service name an app already has. */
-var WorkerNameTaken = class extends Error {
+var WorkerNameTaken = class extends require_errors.GkmError {
 	worker;
 	service;
 	constructor(worker, service) {
@@ -6691,7 +6692,7 @@ const DEV_SERVICES = ["minio", "mailpit"];
 */
 const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
 /** Dev services asked of a target that runs no containers. */
-var DevServicesNeedServerTarget = class extends Error {
+var DevServicesNeedServerTarget = class extends require_errors.GkmError {
 	target;
 	constructor(target) {
 		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services.`);
@@ -6704,7 +6705,7 @@ var DevServicesNeedServerTarget = class extends Error {
 * switch now: every construct the stage does not account for gets its dev
 * service.
 */
-var AllowDevServicesTakesNoValue = class extends Error {
+var AllowDevServicesTakesNoValue = class extends require_errors.GkmError {
 	value;
 	constructor(value) {
 		super(`--allow-dev-services takes no value (it was given '${value}'). It runs the dev service for every bucket and mail the stage does not account for — no key in its secrets, no provider in deploy.<kind>.<stage> — so there is nothing to list. Pass --allow-dev-services on its own.`);
@@ -6732,7 +6733,7 @@ function assertDevServicesFlag(argv) {
 * A deployed stage with mail or object storage that its secrets do not
 * configure — every missing key, across every app, at once.
 */
-var ExternalServicesNotConfigured = class extends Error {
+var ExternalServicesNotConfigured = class extends require_errors.GkmError {
 	stage;
 	missing;
 	constructor(stage, missing) {
@@ -6949,6 +6950,126 @@ function reportDevServices(ctx, uses) {
 	}
 }
 //#endregion
+//#region src/deploy/actor.ts
+/**
+* Who wrote a stage's deploy state: a GitHub Actions run, or a person at a
+* machine. Recorded on every state write (`updatedBy`), on every resource
+* record and on every release (`releasedBy`), so "who put this here" has an
+* answer that does not depend on anyone's memory.
+*/
+/** Whether `env` is a CI job — GitHub Actions or any runner that sets `CI`. */
+function isCi(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" || env.CI === "true";
+}
+/** Who this process is writing as. */
+function currentActor(env = process.env) {
+	if (env.GITHUB_ACTIONS === "true") {
+		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+		return {
+			kind: "github",
+			actor: env.GITHUB_ACTOR ?? "unknown",
+			run: `${server}/${env.GITHUB_REPOSITORY ?? "unknown"}/actions/runs/${env.GITHUB_RUN_ID ?? "unknown"}`,
+			...env.GITHUB_WORKFLOW ? { workflow: env.GITHUB_WORKFLOW } : {}
+		};
+	}
+	let user = "unknown";
+	try {
+		user = (0, node_os.userInfo)().username;
+	} catch {}
+	return {
+		kind: "local",
+		user,
+		host: (0, node_os.hostname)()
+	};
+}
+/** `octocat (deploy, https://github.com/…/runs/1)` or `ada@laptop`. */
+function describeActor(actor) {
+	if (!actor) return "unknown";
+	if (actor.kind === "local") return `${actor.user}@${actor.host}`;
+	return `${actor.actor} (${actor.workflow ? `${actor.workflow}, ` : ""}${actor.run})`;
+}
+//#endregion
+//#region src/deploy/dnsResources.ts
+/** The resource type of a DNS record gkm wrote. */
+const DNS_RECORD_RESOURCE = "dns-record";
+/** A record's full name: `api.example.com`, or the domain for `@`. */
+function dnsRecordFqdn(domain, name) {
+	return name === "@" || name === "" ? domain : `${name}.${domain}`;
+}
+/** `dns-record:<fqdn>:<type>` */
+function dnsResourceKey(fqdn, type) {
+	return `${DNS_RECORD_RESOURCE}:${fqdn.toLowerCase()}:${type.toUpperCase()}`;
+}
+/** The resource record a written DNS record is kept as. */
+function dnsRecordResource(record) {
+	const fqdn = dnsRecordFqdn(record.domain, record.name).toLowerCase();
+	const type = record.type.toUpperCase();
+	const data = {
+		domain: record.domain,
+		name: record.name,
+		value: record.value,
+		ttl: record.ttl,
+		...record.provider ? { provider: record.provider } : {}
+	};
+	return {
+		key: dnsResourceKey(fqdn, type),
+		type: DNS_RECORD_RESOURCE,
+		id: `${fqdn} ${type}`,
+		status: "ready",
+		data
+	};
+}
+/** Records that gkm wrote `record` — or updates the value it holds. */
+async function recordDnsResource(journal, record) {
+	const { key, type, id, data } = dnsRecordResource(record);
+	await journal.ready({
+		key,
+		type,
+		...data ? { data } : {}
+	}, id);
+}
+/** Forgets a DNS record gkm deleted. */
+async function forgetDnsResource(journal, record) {
+	await journal.forget(dnsResourceKey(dnsRecordFqdn(record.domain, record.name), record.type));
+}
+/**
+* The changes a DNS step made, kept: what it created, updated or wrote is
+* recorded, what it deleted is forgotten. A record it found already right is
+* recorded only if gkm wrote it before; one it left to a person is not.
+*/
+async function recordDnsChanges(journal, changes, providerOf) {
+	for (const change of changes) {
+		if (change.action === "delete") {
+			await forgetDnsResource(journal, change);
+			continue;
+		}
+		const written = change.action === "create" || change.action === "update" || change.action === "write";
+		const known = change.action === "unchanged" && journal.record(dnsResourceKey(dnsRecordFqdn(change.domain, change.name), change.type)) !== void 0;
+		if (!written && !known || change.value === void 0) continue;
+		const provider = providerOf(change.domain);
+		await recordDnsResource(journal, {
+			domain: change.domain,
+			name: change.name,
+			type: change.type,
+			value: change.value,
+			ttl: change.ttl ?? 0,
+			...provider ? { provider } : {}
+		});
+	}
+}
+/** Every DNS record gkm wrote for the stage, from its resource records. */
+function dnsResources(resources) {
+	return Object.values(resources).filter((record) => record.type === DNS_RECORD_RESOURCE).map((record) => {
+		const data = record.data ?? {};
+		const [fqdn = "", type = ""] = (record.id ?? "").split(" ");
+		return {
+			...data,
+			type,
+			fqdn
+		};
+	}).sort((a, b) => a.fqdn.localeCompare(b.fqdn) || a.type.localeCompare(b.type));
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -6956,29 +7077,7 @@ function reportDevServices(ctx, uses) {
 function isStateProvider(value) {
 	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
 }
-//#endregion
-//#region src/deploy/StateStore.ts
-/**
-* Deploy state store.
-*
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
-*
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
-*/
-var StateLocked = class extends Error {
+var StateLocked = class extends require_errors.GkmError {
 	stage;
 	holder;
 	location;
@@ -6991,7 +7090,7 @@ var StateLocked = class extends Error {
 		this.name = "StateLocked";
 	}
 };
-var StateVersionConflict = class extends Error {
+var StateVersionConflict = class extends require_errors.GkmError {
 	stage;
 	expectedVersion;
 	actualVersion;
@@ -7003,7 +7102,7 @@ var StateVersionConflict = class extends Error {
 		this.name = "StateVersionConflict";
 	}
 };
-var StageStateMissing = class extends Error {
+var StageStateMissing = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
@@ -7011,7 +7110,7 @@ var StageStateMissing = class extends Error {
 		this.name = "StageStateMissing";
 	}
 };
-var StateUnreadable = class extends Error {
+var StateUnreadable = class extends require_errors.GkmError {
 	stage;
 	location;
 	constructor(stage, location, cause) {
@@ -7021,11 +7120,11 @@ var StateUnreadable = class extends Error {
 		this.name = "StateUnreadable";
 	}
 };
-var StateSchemaTooNew = class extends Error {
+var StateSchemaTooNew = class extends require_errors.GkmError {
 	stage;
 	schemaVersion;
 	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (3). Upgrade @geekmidas/cli to the version that wrote it.`);
 		this.stage = stage;
 		this.schemaVersion = schemaVersion;
 		this.name = "StateSchemaTooNew";
@@ -7036,7 +7135,7 @@ var StateSchemaTooNew = class extends Error {
 * in for a store, so a deploy that cannot be protected from a concurrent one
 * says so.
 */
-var StateStoreWithoutLocking = class extends Error {
+var StateStoreWithoutLocking = class extends require_errors.GkmError {
 	provider;
 	constructor(provider) {
 		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
@@ -7044,7 +7143,7 @@ var StateStoreWithoutLocking = class extends Error {
 		this.name = "StateStoreWithoutLocking";
 	}
 };
-var StateStoreNeedsWorkspaceName = class extends Error {
+var StateStoreNeedsWorkspaceName = class extends require_errors.GkmError {
 	provider;
 	constructor(provider) {
 		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
@@ -7052,7 +7151,7 @@ var StateStoreNeedsWorkspaceName = class extends Error {
 		this.name = "StateStoreNeedsWorkspaceName";
 	}
 };
-var UnknownStateProvider = class extends Error {
+var UnknownStateProvider = class extends require_errors.GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
@@ -7060,8 +7159,24 @@ var UnknownStateProvider = class extends Error {
 		this.name = "UnknownStateProvider";
 	}
 };
+/**
+* A deploy, setup or rollback of a stage in CI, with the stage's state kept on
+* the runner — which is discarded when the job ends.
+*/
+var LocalStateInCi = class extends require_errors.GkmError {
+	stage;
+	operation;
+	region;
+	constructor(stage, operation, region) {
+		super(`\`gkm ${operation}\` would keep stage '${stage}'s deploy state in .gkm/ on this CI runner, and the runner is discarded when the job ends: the next run would start without it — no releases to roll back to, no record of what was created. Keep the state in AWS — in gkm.config.ts:\n\n  state: { provider: 'ssm', region: '${region}' },\n\nthen move the state you already have, from the machine that holds it:\n\n  gkm state:push --stage ${stage}\n`);
+		this.stage = stage;
+		this.operation = operation;
+		this.region = region;
+		this.name = "LocalStateInCi";
+	}
+};
 /** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
+var StateStoreBusy = class extends require_errors.GkmError {
 	stage;
 	location;
 	constructor(stage, location) {
@@ -7088,6 +7203,10 @@ function decodeDocument(stage, body, location) {
 		schemaVersion: 2,
 		document: parsed
 	};
+	if (schemaVersion === 3) return {
+		schemaVersion: 3,
+		document: parsed
+	};
 	throw new StateSchemaTooNew(stage, schemaVersion);
 }
 function encodeDocument(document) {
@@ -7127,6 +7246,79 @@ function migrateV1(stage, state) {
 		updatedAt: now
 	};
 }
+const isEmpty = (value) => !value || Object.keys(value).length === 0;
+/**
+* Whether a v2 state in the Dokploy shape was written by the compose target.
+*
+* Before v3 every target wrote the Dokploy shape, and compose filled none of
+* its Dokploy fields. So the rule is the shape's content, not the target the
+* workspace names now: a state whose every Dokploy-only field is empty — no
+* project or environment id, no application or service ids, no credentials,
+* generated secrets, backups or registry — holds nothing only Dokploy could
+* use, and reading it as compose loses nothing. One with any of them was
+* written by Dokploy and is kept exactly as it is.
+*
+* The configured target is not used: a document decodes the same wherever it
+* is read (`state:show`, `state:push`) without a workspace, a stage can be
+* moved between targets, and `--target` can override a run.
+*/
+function writtenByCompose(state) {
+	return !state.projectId && !state.environmentId && isEmpty(state.applications) && !state.services?.postgresId && !state.services?.redisId && isEmpty(state.appCredentials) && isEmpty(state.generatedSecrets) && !state.backups && !state.registryId;
+}
+/**
+* A v2 state and its records as v3 keeps them. A compose-written state
+* becomes the compose shape: its `dnsRecords` become `dns-record` resources,
+* and `dnsVerified` and the empty Dokploy fields go — the DNS check is made
+* on every deploy. A Dokploy state is returned as it is.
+*/
+function upgradeV2State(state, resources) {
+	if (!writtenByCompose(state)) return {
+		state,
+		resources
+	};
+	const compose = {
+		provider: "compose",
+		stage: state.stage,
+		lastDeployedAt: state.lastDeployedAt,
+		...state.identity ? { identity: state.identity } : {},
+		...state.releases ? { releases: state.releases } : {}
+	};
+	const upgraded = { ...resources };
+	for (const record of Object.values(state.dnsRecords ?? {})) {
+		const resource = migratedDnsResource(record);
+		upgraded[resource.key] = resource;
+	}
+	return {
+		state: compose,
+		resources: upgraded
+	};
+}
+/** A v2 `dnsRecords` entry as the `dns-record` resource v3 keeps. */
+function migratedDnsResource(record) {
+	return {
+		...dnsRecordResource({
+			domain: record.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		}),
+		updatedAt: record.createdAt
+	};
+}
+/** A v2 document as v3 — not written until the next write. */
+function migrateV2(document) {
+	const { state, resources } = upgradeV2State(document.state, document.resources);
+	return {
+		schemaVersion: 3,
+		stage: document.stage,
+		serial: document.serial,
+		state,
+		resources,
+		updatedAt: document.updatedAt,
+		history: []
+	};
+}
 function newLockHolder(options) {
 	let owner = "unknown";
 	try {
@@ -7145,14 +7337,33 @@ function contentVersion(body) {
 	return (0, node_crypto.createHash)("sha256").update(body).digest("hex").slice(0, 16);
 }
 /**
+* `history` with this write at its head. A run makes many writes — one per
+* resource it journals — so a run is one entry: a write by the run that
+* wrote the newest entry (the same lock) replaces it, and any other is
+* added. Without a lock, each write is its own entry.
+*/
+function appendHistory(history, entry, sameRun) {
+	return [entry, ...sameRun ? history.slice(1) : history].slice(0, 20);
+}
+/**
 * A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
+* stage, and create a lock object only if it does not exist. Migration,
+* resource records and history are the same for every such backend, so they
+* live here.
 */
 var DocumentStateStore = class {
+	/** The lock this store holds for each stage — what its writes are for. */
+	held = /* @__PURE__ */ new Map();
+	/** Per stage, the lock whose run wrote the newest history entry. */
+	logged = /* @__PURE__ */ new Map();
+	/** Who this store writes as. */
+	actor() {
+		return currentActor();
+	}
 	async lock(stage, options) {
 		const holder = newLockHolder(options);
 		await this.createLock(stage, holder);
+		this.held.set(stage, holder);
 		let released = false;
 		return {
 			stage,
@@ -7160,6 +7371,7 @@ var DocumentStateStore = class {
 			release: async () => {
 				if (released) return;
 				released = true;
+				if (this.held.get(stage)?.id === holder.id) this.held.delete(stage);
 				await this.removeLock(stage, holder);
 			}
 		};
@@ -7175,19 +7387,21 @@ var DocumentStateStore = class {
 		return {
 			state: current.document.state,
 			resources: current.document.resources,
+			history: current.document.history,
 			version: current.version
 		};
 	}
 	async write(stage, state, options) {
 		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
+			const document = this.stamp(stage, {
+				schemaVersion: 3,
 				stage,
 				serial: 1,
 				state,
 				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				history: []
+			});
 			return this.writeRaw(stage, encodeDocument(document), null);
 		}
 		return this.mutate(stage, options.expectedVersion, (document) => ({
@@ -7202,7 +7416,8 @@ var DocumentStateStore = class {
 				...document.resources,
 				[record.key]: {
 					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					updatedBy: this.actor()
 				}
 			}
 		}));
@@ -7216,6 +7431,25 @@ var DocumentStateStore = class {
 			};
 		});
 	}
+	/** `document` as this write leaves it: who wrote it, in its history. */
+	stamp(stage, document) {
+		const by = this.actor();
+		const holder = this.held.get(stage);
+		const operation = holder?.operation ?? "write";
+		const history = document.history ?? [];
+		const sameRun = holder !== void 0 && this.logged.get(stage) === holder.id && history[0]?.operation === operation;
+		if (holder) this.logged.set(stage, holder.id);
+		return {
+			...document,
+			updatedBy: by,
+			history: appendHistory(history, {
+				serial: document.serial,
+				at: document.updatedAt,
+				by,
+				operation
+			}, sameRun)
+		};
+	}
 	async mutate(stage, expectedVersion, change) {
 		const current = await this.readDocument(stage);
 		if (!current) {
@@ -7224,25 +7458,31 @@ var DocumentStateStore = class {
 		}
 		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
 		const next = change(current.document);
+		next.schemaVersion = 3;
 		next.serial = current.document.serial + 1;
 		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
+		return this.writeRaw(stage, encodeDocument(this.stamp(stage, next)), current.version);
 	}
 	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
+	* Reads the stage's document as v3. A v1 document is migrated in place on
+	* the way — itself a conditional write: if another run migrated (or wrote)
+	* first, its result is read instead. A v2 document is upgraded in memory
+	* and written as v3 by the next write.
 	*/
 	async readDocument(stage, attempt = 0) {
 		const raw = await this.readRaw(stage);
 		if (!raw) return null;
 		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
+		if (decoded.schemaVersion === 3) return {
 			document: decoded.document,
 			version: raw.version
 		};
+		if (decoded.schemaVersion === 2) return {
+			document: migrateV2(decoded.document),
+			version: raw.version
+		};
 		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
+		const document = this.stamp(stage, migrateV2(migrateV1(stage, decoded.state)));
 		try {
 			return {
 				document,
@@ -7254,6 +7494,22 @@ var DocumentStateStore = class {
 		}
 	}
 };
+/** Whether `config` keeps state on this machine — `local`, or none given. */
+function isLocalState(config) {
+	return !config || config.provider === "local";
+}
+/**
+* Refuses, with `LocalStateInCi`, a run that would write a deployed stage's
+* state to a CI runner's disk — the local stage, which runs on the runner
+* itself, is exempt. Local use is untouched. The region the message
+* suggests is the secrets store's, when the workspace keeps them in AWS.
+*/
+function assertStateOutlivesRun(workspace, stage, operation, env = process.env) {
+	if (stage === workspace.stages?.local) return;
+	if (!isCi(env) || !isLocalState(workspace.state)) return;
+	const store = workspace.secrets?.store;
+	throw new LocalStateInCi(stage, operation, typeof store === "object" && store && typeof store.region === "string" ? store.region : "<region>");
+}
 function isStateStore(value) {
 	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
 }
@@ -7270,17 +7526,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-BBeTlRTH.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-oX_zxj9V.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-DXmNA7hy.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-BlYXQQSE.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DoZE1Wi1.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-CaCtrzFL.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7290,7 +7546,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-Br8VMY22.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-DeI7jtvi.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7325,7 +7581,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-CyTpG_jy.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-C6t-PSNe.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -7338,7 +7594,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-DqZ1qD_F.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-BZb-V14e.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7349,7 +7605,7 @@ async function createDnsProvider(options) {
 * scoped to updates only. What reads them falls back to writing every record,
 * which is idempotent, without a diff.
 */
-var DnsRecordsUnreadable = class extends Error {
+var DnsRecordsUnreadable = class extends require_errors.GkmError {
 	provider;
 	domain;
 	reason;
@@ -7371,7 +7627,7 @@ var DnsProviderNotImplemented = class extends Error {
 	}
 };
 /** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
-var DnsProviderUnknown = class extends Error {
+var DnsProviderUnknown = class extends require_errors.GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
@@ -7382,10 +7638,16 @@ var DnsProviderUnknown = class extends Error {
 //#endregion
 //#region src/deploy/state.ts
 /**
-* Deploy state management for Dokploy deployments
+* A stage's deploy state.
+*
+* Every target records the same core — when the stage was last deployed, by
+* which identity, and each app's releases — and a target that keeps ids of
+* its own adds them in a shape of its own, told apart by `provider`:
 *
-* Stores resource IDs (applications, services) per stage to avoid
-* re-creating resources on subsequent deploys.
+* - `dokploy`: the project, applications, services and credentials Dokploy
+*   gave the stage, so a later deploy updates them rather than making more.
+* - `compose`: nothing beyond the core. A compose stage is one stack on one
+*   server; what it created elsewhere (DNS records) is a resource record.
 */
 /**
 * Create a new empty state for a stage
@@ -7401,6 +7663,31 @@ function createEmptyState(stage, projectId, environmentId) {
 		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
+/** A new compose stage's state. */
+function createComposeState(stage) {
+	return {
+		provider: "compose",
+		stage,
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* `state` as the Dokploy target keeps it. A stage whose state another target
+* wrote — one moved from compose to Dokploy — keeps its core (releases,
+* identity) and starts with no Dokploy ids, as a first deploy would.
+*/
+function asDokployState(state) {
+	if (state.provider === "dokploy") return state;
+	const { provider: _provider, ...core } = state;
+	return {
+		...core,
+		provider: "dokploy",
+		projectId: "",
+		environmentId: "",
+		applications: {},
+		services: {}
+	};
+}
 /**
 * Set application ID in state (mutates state)
 */
@@ -7420,12 +7707,13 @@ function restorable(history, index, current) {
 * `current`, and what was current becomes `previous`. Releasing what already
 * runs — a redeploy of the same digest — changes nothing.
 */
-function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+function recordRelease(state, appName, image, by, releasedAt = /* @__PURE__ */ new Date()) {
 	const releases = state.releases?.[appName];
 	if (releases && sameImage(releases.current, image)) return;
 	const entry = {
 		...image,
-		releasedAt: releasedAt.toISOString()
+		releasedAt: releasedAt.toISOString(),
+		releasedBy: by
 	};
 	const history = [entry, ...releases?.history ?? []].slice(0, 10);
 	const previous = releases?.current;
@@ -7873,6 +8161,422 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${require_workspace.SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends require_errors.GkmError {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === require_workspace.SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends require_errors.GkmError {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${require_workspace.SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${require_workspace.SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[require_workspace.SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[require_workspace.SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !(0, node_net.isIPv6)(ipv6)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!(0, node_net.isIPv4)(ipv4)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = require_workspace.cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${require_workspace.SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await (0, node_dns_promises.lookup)(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends require_errors.GkmError {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -7891,7 +8595,7 @@ const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPON
 /** Docker refuses a repository name longer than this. */
 const MAX_NAME_LENGTH = 255;
 /** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends Error {
+var ImageRefInvalid = class extends require_errors.GkmError {
 	ref;
 	constructor(ref) {
 		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
@@ -7927,7 +8631,7 @@ var DockerPushFailed = class extends Error {
 	}
 };
 /** `gkm docker --push` was asked for with nowhere to push to. */
-var PushNeedsRegistry = class extends Error {
+var PushNeedsRegistry = class extends require_errors.GkmError {
 	imageName;
 	constructor(imageName) {
 		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
@@ -8194,7 +8898,7 @@ function constructsOf$1(manifest, kind) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
 }
 /** A stage that names `false` for a kind, and declares constructs of it. */
-var StageProviderDisabled = class extends Error {
+var StageProviderDisabled = class extends require_errors.GkmError {
 	kind;
 	stage;
 	ids;
@@ -8265,14 +8969,9 @@ var DeployJournal = class DeployJournal {
 		this.version = version;
 		this.existed = existed;
 	}
-	/**
-	* The stage's journal — its stored state, or `initial` written as the
-	* stage's first state, so there is somewhere to record the very first
-	* resource before it is created.
-	*/
-	static async open(store, stage, initial) {
+	static async open(store, stage, initial, adopt = (stored) => stored) {
 		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
 		const state = initial();
 		const version = await store.write(stage, state, { expectedVersion: null });
 		return new DeployJournal(store, stage, state, {}, version, false);
@@ -8291,10 +8990,13 @@ var DeployJournal = class DeployJournal {
 			status: "pending"
 		});
 	}
-	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
 	async ready(entry, id) {
 		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id) return;
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
 		await this.put({
 			...entry,
 			status: "ready",
@@ -8339,6 +9041,17 @@ var DeployJournal = class DeployJournal {
 			...staleId ? { staleId } : {}
 		};
 	}
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
 	/** Writes the stage's state, keeping its resource records. */
 	async save() {
 		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -8356,6 +9069,138 @@ var DeployJournal = class DeployJournal {
 	}
 };
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
+	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await Promise.resolve().then(() => require("./secrets-DJteijZo.cjs")).then((n) => n.secrets_exports);
+	const { composeStack } = await Promise.resolve().then(() => require("./stack-1PeLJS2j.cjs")).then((n) => n.stack_exports);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	return stackHosts(composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	}));
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const server = serverAddress(stage, (await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		const changes = await applyStackDns(plan, {
+			...options.dryRun ? { dryRun: true } : {},
+			log,
+			credentials: {
+				env: options.env ?? process.env,
+				...options.home ? { home: options.home } : {},
+				log
+			},
+			...options.providerFor ? { providerFor: options.providerFor } : {}
+		});
+		if (options.journal && !options.dryRun) {
+			const providers = new Map(plan.domains.map((domain) => [domain.domain, domain.provider]));
+			await recordDnsChanges(options.journal, changes, (domain) => providers.get(domain));
+		}
+		return {
+			mode: "records",
+			hosts,
+			changes
+		};
+	} catch (error) {
+		if (error instanceof require_credentials.MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/providers/aws.ts
 /**
 * The AWS account a provider provisions in — the stage's, found the way the
@@ -8430,7 +9275,7 @@ async function awsClientConfig(credential, region) {
 }
 const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 /** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends Error {
+var InvalidBucketName = class extends require_errors.GkmError {
 	bucket;
 	reason;
 	constructor(bucket, reason) {
@@ -9327,7 +10172,7 @@ async function provisionStage(options) {
 	});
 	const lock = dryRun ? void 0 : await stateStore.lock(stage, { operation: "provision" });
 	try {
-		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => createEmptyState(stage, "", "")));
+		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
 		const writeSecrets = async (values) => {
 			if (dryRun) return;
 			const stored = await secretsStore.read(stage) ?? initStageSecrets(stage);
@@ -9432,7 +10277,7 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 * `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
 * generated. Set by hand wins over derived, so the app would be handed it.
 */
-var StaleStageSecrets = class extends Error {
+var StaleStageSecrets = class extends require_errors.GkmError {
 	stage;
 	stale;
 	constructor(stage, stale) {
@@ -9638,6 +10483,12 @@ Object.defineProperty(exports, "FileSecretsStore", {
 		return FileSecretsStore;
 	}
 });
+Object.defineProperty(exports, "HostNotPointingAtServer", {
+	enumerable: true,
+	get: function() {
+		return HostNotPointingAtServer;
+	}
+});
 Object.defineProperty(exports, "LEGACY_LOCAL_LOGIN", {
 	enumerable: true,
 	get: function() {
@@ -9668,6 +10519,12 @@ Object.defineProperty(exports, "LOGS_SERVICE", {
 		return LOGS_SERVICE;
 	}
 });
+Object.defineProperty(exports, "LocalStateInCi", {
+	enumerable: true,
+	get: function() {
+		return LocalStateInCi;
+	}
+});
 Object.defineProperty(exports, "NoDomainForStage", {
 	enumerable: true,
 	get: function() {
@@ -9776,6 +10633,12 @@ Object.defineProperty(exports, "appTelemetry", {
 		return appTelemetry;
 	}
 });
+Object.defineProperty(exports, "appendHistory", {
+	enumerable: true,
+	get: function() {
+		return appendHistory;
+	}
+});
 Object.defineProperty(exports, "applicationName", {
 	enumerable: true,
 	get: function() {
@@ -9800,6 +10663,12 @@ Object.defineProperty(exports, "applyPostgres", {
 		return applyPostgres;
 	}
 });
+Object.defineProperty(exports, "asDokployState", {
+	enumerable: true,
+	get: function() {
+		return asDokployState;
+	}
+});
 Object.defineProperty(exports, "assertDevServicesFlag", {
 	enumerable: true,
 	get: function() {
@@ -9824,6 +10693,18 @@ Object.defineProperty(exports, "assertStageProvidersEnabled", {
 		return assertStageProvidersEnabled;
 	}
 });
+Object.defineProperty(exports, "assertStageServer", {
+	enumerable: true,
+	get: function() {
+		return assertStageServer;
+	}
+});
+Object.defineProperty(exports, "assertStateOutlivesRun", {
+	enumerable: true,
+	get: function() {
+		return assertStateOutlivesRun;
+	}
+});
 Object.defineProperty(exports, "backendsOf", {
 	enumerable: true,
 	get: function() {
@@ -9848,6 +10729,12 @@ Object.defineProperty(exports, "cacheBackendFor", {
 		return cacheBackendFor;
 	}
 });
+Object.defineProperty(exports, "checkStackDns", {
+	enumerable: true,
+	get: function() {
+		return checkStackDns;
+	}
+});
 Object.defineProperty(exports, "composeBuildPaths", {
 	enumerable: true,
 	get: function() {
@@ -9872,16 +10759,16 @@ Object.defineProperty(exports, "contentVersion", {
 		return contentVersion;
 	}
 });
-Object.defineProperty(exports, "createCredentialsPreload", {
+Object.defineProperty(exports, "createComposeState", {
 	enumerable: true,
 	get: function() {
-		return createCredentialsPreload;
+		return createComposeState;
 	}
 });
-Object.defineProperty(exports, "createDnsProvider", {
+Object.defineProperty(exports, "createCredentialsPreload", {
 	enumerable: true,
 	get: function() {
-		return createDnsProvider;
+		return createCredentialsPreload;
 	}
 });
 Object.defineProperty(exports, "createEmptyState", {
@@ -9902,18 +10789,36 @@ Object.defineProperty(exports, "createStateStore", {
 		return createStateStore;
 	}
 });
+Object.defineProperty(exports, "currentActor", {
+	enumerable: true,
+	get: function() {
+		return currentActor;
+	}
+});
 Object.defineProperty(exports, "deployIdentity", {
 	enumerable: true,
 	get: function() {
 		return deployIdentity;
 	}
 });
+Object.defineProperty(exports, "deploysWithCompose", {
+	enumerable: true,
+	get: function() {
+		return deploysWithCompose;
+	}
+});
 Object.defineProperty(exports, "derivedContainers", {
 	enumerable: true,
 	get: function() {
 		return derivedContainers;
 	}
 });
+Object.defineProperty(exports, "describeActor", {
+	enumerable: true,
+	get: function() {
+		return describeActor;
+	}
+});
 Object.defineProperty(exports, "describeServices", {
 	enumerable: true,
 	get: function() {
@@ -9932,6 +10837,12 @@ Object.defineProperty(exports, "devServicesUsed", {
 		return devServicesUsed;
 	}
 });
+Object.defineProperty(exports, "dnsResources", {
+	enumerable: true,
+	get: function() {
+		return dnsResources;
+	}
+});
 Object.defineProperty(exports, "dockerCommand", {
 	enumerable: true,
 	get: function() {
@@ -9974,12 +10885,6 @@ Object.defineProperty(exports, "externalServices", {
 		return externalServices;
 	}
 });
-Object.defineProperty(exports, "extractSubdomain", {
-	enumerable: true,
-	get: function() {
-		return extractSubdomain;
-	}
-});
 Object.defineProperty(exports, "fakeKey", {
 	enumerable: true,
 	get: function() {
@@ -9998,12 +10903,6 @@ Object.defineProperty(exports, "findBuildRoot", {
 		return findBuildRoot;
 	}
 });
-Object.defineProperty(exports, "findRootDomain", {
-	enumerable: true,
-	get: function() {
-		return findRootDomain;
-	}
-});
 Object.defineProperty(exports, "forgetState", {
 	enumerable: true,
 	get: function() {
@@ -10070,6 +10969,12 @@ Object.defineProperty(exports, "isImageBuild", {
 		return isImageBuild;
 	}
 });
+Object.defineProperty(exports, "isLocalHost", {
+	enumerable: true,
+	get: function() {
+		return isLocalHost;
+	}
+});
 Object.defineProperty(exports, "isMainFrontendApp", {
 	enumerable: true,
 	get: function() {
@@ -10178,12 +11083,6 @@ Object.defineProperty(exports, "newLockHolder", {
 		return newLockHolder;
 	}
 });
-Object.defineProperty(exports, "normalizeDnsConfig", {
-	enumerable: true,
-	get: function() {
-		return normalizeDnsConfig;
-	}
-});
 Object.defineProperty(exports, "orchestrateDns", {
 	enumerable: true,
 	get: function() {
@@ -10280,6 +11179,12 @@ Object.defineProperty(exports, "provisionStage", {
 		return provisionStage;
 	}
 });
+Object.defineProperty(exports, "provisionStageDns", {
+	enumerable: true,
+	get: function() {
+		return provisionStageDns;
+	}
+});
 Object.defineProperty(exports, "quoteIdentifier", {
 	enumerable: true,
 	get: function() {
@@ -10340,6 +11245,12 @@ Object.defineProperty(exports, "reportPlannedSeeds", {
 		return reportPlannedSeeds;
 	}
 });
+Object.defineProperty(exports, "requiredServerAddress", {
+	enumerable: true,
+	get: function() {
+		return requiredServerAddress;
+	}
+});
 Object.defineProperty(exports, "requiredStageKeys", {
 	enumerable: true,
 	get: function() {
@@ -10376,6 +11287,12 @@ Object.defineProperty(exports, "secretsStoreFor", {
 		return secretsStoreFor;
 	}
 });
+Object.defineProperty(exports, "serverAddressHint", {
+	enumerable: true,
+	get: function() {
+		return serverAddressHint;
+	}
+});
 Object.defineProperty(exports, "setApplicationId", {
 	enumerable: true,
 	get: function() {
@@ -10400,6 +11317,12 @@ Object.defineProperty(exports, "setPostgresBackupId", {
 		return setPostgresBackupId;
 	}
 });
+Object.defineProperty(exports, "stackHosts", {
+	enumerable: true,
+	get: function() {
+		return stackHosts;
+	}
+});
 Object.defineProperty(exports, "stackLogs", {
 	enumerable: true,
 	get: function() {
@@ -10454,6 +11377,12 @@ Object.defineProperty(exports, "surfaceClientTraced", {
 		return surfaceClientTraced;
 	}
 });
+Object.defineProperty(exports, "systemLookup", {
+	enumerable: true,
+	get: function() {
+		return systemLookup;
+	}
+});
 Object.defineProperty(exports, "telemetryOf", {
 	enumerable: true,
 	get: function() {
@@ -10466,6 +11395,12 @@ Object.defineProperty(exports, "toEmbeddableSecrets", {
 		return toEmbeddableSecrets;
 	}
 });
+Object.defineProperty(exports, "upgradeV2State", {
+	enumerable: true,
+	get: function() {
+		return upgradeV2State;
+	}
+});
 Object.defineProperty(exports, "usesTelemetry", {
 	enumerable: true,
 	get: function() {
@@ -10557,4 +11492,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-CkIPFGNO.cjs.map
+//# sourceMappingURL=seeds-c-ByX9je.cjs.map