@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.93

package/dist/{seeds-CvGQJnPO.mjs → seeds-BSL55F6q.mjs}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { r as storedCredentials, s as run$1, x as gkmHome } from "./credentials-C4KII3PD.mjs";
+import { r as storedCredentials, s as run$1, t as MissingCredential, x as gkmHome } from "./credentials-C4KII3PD.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-Bzw7Zs82.mjs";
+import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, ot as cnameTarget, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-Bzw7Zs82.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
-import { c as runtimeOf } from "./resolve-Be4bF1w4.mjs";
+import { c as runtimeOf } from "./resolve-Ccjlpnd9.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -16,7 +16,7 @@ import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
 import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
-import { createServer } from "node:net";
+import { createServer, isIPv4, isIPv6 } from "node:net";
 import { execFile, spawn } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { config } from "dotenv";
@@ -6947,6 +6947,126 @@ function reportDevServices(ctx, uses) {
 	}
 }
 //#endregion
+//#region src/deploy/actor.ts
+/**
+* Who wrote a stage's deploy state: a GitHub Actions run, or a person at a
+* machine. Recorded on every state write (`updatedBy`), on every resource
+* record and on every release (`releasedBy`), so "who put this here" has an
+* answer that does not depend on anyone's memory.
+*/
+/** Whether `env` is a CI job — GitHub Actions or any runner that sets `CI`. */
+function isCi(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" || env.CI === "true";
+}
+/** Who this process is writing as. */
+function currentActor(env = process.env) {
+	if (env.GITHUB_ACTIONS === "true") {
+		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+		return {
+			kind: "github",
+			actor: env.GITHUB_ACTOR ?? "unknown",
+			run: `${server}/${env.GITHUB_REPOSITORY ?? "unknown"}/actions/runs/${env.GITHUB_RUN_ID ?? "unknown"}`,
+			...env.GITHUB_WORKFLOW ? { workflow: env.GITHUB_WORKFLOW } : {}
+		};
+	}
+	let user = "unknown";
+	try {
+		user = userInfo().username;
+	} catch {}
+	return {
+		kind: "local",
+		user,
+		host: hostname()
+	};
+}
+/** `octocat (deploy, https://github.com/…/runs/1)` or `ada@laptop`. */
+function describeActor(actor) {
+	if (!actor) return "unknown";
+	if (actor.kind === "local") return `${actor.user}@${actor.host}`;
+	return `${actor.actor} (${actor.workflow ? `${actor.workflow}, ` : ""}${actor.run})`;
+}
+//#endregion
+//#region src/deploy/dnsResources.ts
+/** The resource type of a DNS record gkm wrote. */
+const DNS_RECORD_RESOURCE = "dns-record";
+/** A record's full name: `api.example.com`, or the domain for `@`. */
+function dnsRecordFqdn(domain, name) {
+	return name === "@" || name === "" ? domain : `${name}.${domain}`;
+}
+/** `dns-record:<fqdn>:<type>` */
+function dnsResourceKey(fqdn, type) {
+	return `${DNS_RECORD_RESOURCE}:${fqdn.toLowerCase()}:${type.toUpperCase()}`;
+}
+/** The resource record a written DNS record is kept as. */
+function dnsRecordResource(record) {
+	const fqdn = dnsRecordFqdn(record.domain, record.name).toLowerCase();
+	const type = record.type.toUpperCase();
+	const data = {
+		domain: record.domain,
+		name: record.name,
+		value: record.value,
+		ttl: record.ttl,
+		...record.provider ? { provider: record.provider } : {}
+	};
+	return {
+		key: dnsResourceKey(fqdn, type),
+		type: DNS_RECORD_RESOURCE,
+		id: `${fqdn} ${type}`,
+		status: "ready",
+		data
+	};
+}
+/** Records that gkm wrote `record` — or updates the value it holds. */
+async function recordDnsResource(journal, record) {
+	const { key, type, id, data } = dnsRecordResource(record);
+	await journal.ready({
+		key,
+		type,
+		...data ? { data } : {}
+	}, id);
+}
+/** Forgets a DNS record gkm deleted. */
+async function forgetDnsResource(journal, record) {
+	await journal.forget(dnsResourceKey(dnsRecordFqdn(record.domain, record.name), record.type));
+}
+/**
+* The changes a DNS step made, kept: what it created, updated or wrote is
+* recorded, what it deleted is forgotten. A record it found already right is
+* recorded only if gkm wrote it before; one it left to a person is not.
+*/
+async function recordDnsChanges(journal, changes, providerOf) {
+	for (const change of changes) {
+		if (change.action === "delete") {
+			await forgetDnsResource(journal, change);
+			continue;
+		}
+		const written = change.action === "create" || change.action === "update" || change.action === "write";
+		const known = change.action === "unchanged" && journal.record(dnsResourceKey(dnsRecordFqdn(change.domain, change.name), change.type)) !== void 0;
+		if (!written && !known || change.value === void 0) continue;
+		const provider = providerOf(change.domain);
+		await recordDnsResource(journal, {
+			domain: change.domain,
+			name: change.name,
+			type: change.type,
+			value: change.value,
+			ttl: change.ttl ?? 0,
+			...provider ? { provider } : {}
+		});
+	}
+}
+/** Every DNS record gkm wrote for the stage, from its resource records. */
+function dnsResources(resources) {
+	return Object.values(resources).filter((record) => record.type === DNS_RECORD_RESOURCE).map((record) => {
+		const data = record.data ?? {};
+		const [fqdn = "", type = ""] = (record.id ?? "").split(" ");
+		return {
+			...data,
+			type,
+			fqdn
+		};
+	}).sort((a, b) => a.fqdn.localeCompare(b.fqdn) || a.type.localeCompare(b.type));
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -6954,28 +7074,6 @@ function reportDevServices(ctx, uses) {
 function isStateProvider(value) {
 	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
 }
-//#endregion
-//#region src/deploy/StateStore.ts
-/**
-* Deploy state store.
-*
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
-*
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
-*/
 var StateLocked = class extends GkmError {
 	stage;
 	holder;
@@ -7023,7 +7121,7 @@ var StateSchemaTooNew = class extends GkmError {
 	stage;
 	schemaVersion;
 	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (3). Upgrade @geekmidas/cli to the version that wrote it.`);
 		this.stage = stage;
 		this.schemaVersion = schemaVersion;
 		this.name = "StateSchemaTooNew";
@@ -7058,6 +7156,22 @@ var UnknownStateProvider = class extends GkmError {
 		this.name = "UnknownStateProvider";
 	}
 };
+/**
+* A deploy, setup or rollback of a stage in CI, with the stage's state kept on
+* the runner — which is discarded when the job ends.
+*/
+var LocalStateInCi = class extends GkmError {
+	stage;
+	operation;
+	region;
+	constructor(stage, operation, region) {
+		super(`\`gkm ${operation}\` would keep stage '${stage}'s deploy state in .gkm/ on this CI runner, and the runner is discarded when the job ends: the next run would start without it — no releases to roll back to, no record of what was created. Keep the state in AWS — in gkm.config.ts:\n\n  state: { provider: 'ssm', region: '${region}' },\n\nthen move the state you already have, from the machine that holds it:\n\n  gkm state:push --stage ${stage}\n`);
+		this.stage = stage;
+		this.operation = operation;
+		this.region = region;
+		this.name = "LocalStateInCi";
+	}
+};
 /** A lock or write that could not get at the state backend in time. */
 var StateStoreBusy = class extends GkmError {
 	stage;
@@ -7086,6 +7200,10 @@ function decodeDocument(stage, body, location) {
 		schemaVersion: 2,
 		document: parsed
 	};
+	if (schemaVersion === 3) return {
+		schemaVersion: 3,
+		document: parsed
+	};
 	throw new StateSchemaTooNew(stage, schemaVersion);
 }
 function encodeDocument(document) {
@@ -7125,6 +7243,79 @@ function migrateV1(stage, state) {
 		updatedAt: now
 	};
 }
+const isEmpty = (value) => !value || Object.keys(value).length === 0;
+/**
+* Whether a v2 state in the Dokploy shape was written by the compose target.
+*
+* Before v3 every target wrote the Dokploy shape, and compose filled none of
+* its Dokploy fields. So the rule is the shape's content, not the target the
+* workspace names now: a state whose every Dokploy-only field is empty — no
+* project or environment id, no application or service ids, no credentials,
+* generated secrets, backups or registry — holds nothing only Dokploy could
+* use, and reading it as compose loses nothing. One with any of them was
+* written by Dokploy and is kept exactly as it is.
+*
+* The configured target is not used: a document decodes the same wherever it
+* is read (`state:show`, `state:push`) without a workspace, a stage can be
+* moved between targets, and `--target` can override a run.
+*/
+function writtenByCompose(state) {
+	return !state.projectId && !state.environmentId && isEmpty(state.applications) && !state.services?.postgresId && !state.services?.redisId && isEmpty(state.appCredentials) && isEmpty(state.generatedSecrets) && !state.backups && !state.registryId;
+}
+/**
+* A v2 state and its records as v3 keeps them. A compose-written state
+* becomes the compose shape: its `dnsRecords` become `dns-record` resources,
+* and `dnsVerified` and the empty Dokploy fields go — the DNS check is made
+* on every deploy. A Dokploy state is returned as it is.
+*/
+function upgradeV2State(state, resources) {
+	if (!writtenByCompose(state)) return {
+		state,
+		resources
+	};
+	const compose = {
+		provider: "compose",
+		stage: state.stage,
+		lastDeployedAt: state.lastDeployedAt,
+		...state.identity ? { identity: state.identity } : {},
+		...state.releases ? { releases: state.releases } : {}
+	};
+	const upgraded = { ...resources };
+	for (const record of Object.values(state.dnsRecords ?? {})) {
+		const resource = migratedDnsResource(record);
+		upgraded[resource.key] = resource;
+	}
+	return {
+		state: compose,
+		resources: upgraded
+	};
+}
+/** A v2 `dnsRecords` entry as the `dns-record` resource v3 keeps. */
+function migratedDnsResource(record) {
+	return {
+		...dnsRecordResource({
+			domain: record.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		}),
+		updatedAt: record.createdAt
+	};
+}
+/** A v2 document as v3 — not written until the next write. */
+function migrateV2(document) {
+	const { state, resources } = upgradeV2State(document.state, document.resources);
+	return {
+		schemaVersion: 3,
+		stage: document.stage,
+		serial: document.serial,
+		state,
+		resources,
+		updatedAt: document.updatedAt,
+		history: []
+	};
+}
 function newLockHolder(options) {
 	let owner = "unknown";
 	try {
@@ -7143,14 +7334,33 @@ function contentVersion(body) {
 	return createHash("sha256").update(body).digest("hex").slice(0, 16);
 }
 /**
+* `history` with this write at its head. A run makes many writes — one per
+* resource it journals — so a run is one entry: a write by the run that
+* wrote the newest entry (the same lock) replaces it, and any other is
+* added. Without a lock, each write is its own entry.
+*/
+function appendHistory(history, entry, sameRun) {
+	return [entry, ...sameRun ? history.slice(1) : history].slice(0, 20);
+}
+/**
 * A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
+* stage, and create a lock object only if it does not exist. Migration,
+* resource records and history are the same for every such backend, so they
+* live here.
 */
 var DocumentStateStore = class {
+	/** The lock this store holds for each stage — what its writes are for. */
+	held = /* @__PURE__ */ new Map();
+	/** Per stage, the lock whose run wrote the newest history entry. */
+	logged = /* @__PURE__ */ new Map();
+	/** Who this store writes as. */
+	actor() {
+		return currentActor();
+	}
 	async lock(stage, options) {
 		const holder = newLockHolder(options);
 		await this.createLock(stage, holder);
+		this.held.set(stage, holder);
 		let released = false;
 		return {
 			stage,
@@ -7158,6 +7368,7 @@ var DocumentStateStore = class {
 			release: async () => {
 				if (released) return;
 				released = true;
+				if (this.held.get(stage)?.id === holder.id) this.held.delete(stage);
 				await this.removeLock(stage, holder);
 			}
 		};
@@ -7173,19 +7384,21 @@ var DocumentStateStore = class {
 		return {
 			state: current.document.state,
 			resources: current.document.resources,
+			history: current.document.history,
 			version: current.version
 		};
 	}
 	async write(stage, state, options) {
 		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
+			const document = this.stamp(stage, {
+				schemaVersion: 3,
 				stage,
 				serial: 1,
 				state,
 				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				history: []
+			});
 			return this.writeRaw(stage, encodeDocument(document), null);
 		}
 		return this.mutate(stage, options.expectedVersion, (document) => ({
@@ -7200,7 +7413,8 @@ var DocumentStateStore = class {
 				...document.resources,
 				[record.key]: {
 					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					updatedBy: this.actor()
 				}
 			}
 		}));
@@ -7214,6 +7428,25 @@ var DocumentStateStore = class {
 			};
 		});
 	}
+	/** `document` as this write leaves it: who wrote it, in its history. */
+	stamp(stage, document) {
+		const by = this.actor();
+		const holder = this.held.get(stage);
+		const operation = holder?.operation ?? "write";
+		const history = document.history ?? [];
+		const sameRun = holder !== void 0 && this.logged.get(stage) === holder.id && history[0]?.operation === operation;
+		if (holder) this.logged.set(stage, holder.id);
+		return {
+			...document,
+			updatedBy: by,
+			history: appendHistory(history, {
+				serial: document.serial,
+				at: document.updatedAt,
+				by,
+				operation
+			}, sameRun)
+		};
+	}
 	async mutate(stage, expectedVersion, change) {
 		const current = await this.readDocument(stage);
 		if (!current) {
@@ -7222,25 +7455,31 @@ var DocumentStateStore = class {
 		}
 		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
 		const next = change(current.document);
+		next.schemaVersion = 3;
 		next.serial = current.document.serial + 1;
 		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
+		return this.writeRaw(stage, encodeDocument(this.stamp(stage, next)), current.version);
 	}
 	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
+	* Reads the stage's document as v3. A v1 document is migrated in place on
+	* the way — itself a conditional write: if another run migrated (or wrote)
+	* first, its result is read instead. A v2 document is upgraded in memory
+	* and written as v3 by the next write.
 	*/
 	async readDocument(stage, attempt = 0) {
 		const raw = await this.readRaw(stage);
 		if (!raw) return null;
 		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
+		if (decoded.schemaVersion === 3) return {
 			document: decoded.document,
 			version: raw.version
 		};
+		if (decoded.schemaVersion === 2) return {
+			document: migrateV2(decoded.document),
+			version: raw.version
+		};
 		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
+		const document = this.stamp(stage, migrateV2(migrateV1(stage, decoded.state)));
 		try {
 			return {
 				document,
@@ -7252,6 +7491,22 @@ var DocumentStateStore = class {
 		}
 	}
 };
+/** Whether `config` keeps state on this machine — `local`, or none given. */
+function isLocalState(config) {
+	return !config || config.provider === "local";
+}
+/**
+* Refuses, with `LocalStateInCi`, a run that would write a deployed stage's
+* state to a CI runner's disk — the local stage, which runs on the runner
+* itself, is exempt. Local use is untouched. The region the message
+* suggests is the secrets store's, when the workspace keeps them in AWS.
+*/
+function assertStateOutlivesRun(workspace, stage, operation, env = process.env) {
+	if (stage === workspace.stages?.local) return;
+	if (!isCi(env) || !isLocalState(workspace.state)) return;
+	const store = workspace.secrets?.store;
+	throw new LocalStateInCi(stage, operation, typeof store === "object" && store && typeof store.region === "string" ? store.region : "<region>");
+}
 function isStateStore(value) {
 	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
 }
@@ -7268,17 +7523,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-Y8XHdoCR.mjs").then((n) => n.n);
+		const { LocalStateStore } = await import("./LocalStateStore-D40_SDmJ.mjs").then((n) => n.n);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-DdJ1bCRV.mjs");
+		const { LegacyStateStore } = await import("./LegacyStateStore-CtwO7fwy.mjs");
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-Bdyw_0Jj.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-k_Ew7TWx.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7288,7 +7543,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-BfoY4MvD.mjs");
+		const { S3StateStore } = await import("./S3StateStore-BzS0IeSt.mjs");
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7336,7 +7591,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-BqYGk9XT.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-Mi3vptSR.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7393,6 +7648,31 @@ function createEmptyState(stage, projectId, environmentId) {
 		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
+/** A new compose stage's state. */
+function createComposeState(stage) {
+	return {
+		provider: "compose",
+		stage,
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* `state` as the Dokploy target keeps it. A stage whose state another target
+* wrote — one moved from compose to Dokploy — keeps its core (releases,
+* identity) and starts with no Dokploy ids, as a first deploy would.
+*/
+function asDokployState(state) {
+	if (state.provider === "dokploy") return state;
+	const { provider: _provider, ...core } = state;
+	return {
+		...core,
+		provider: "dokploy",
+		projectId: "",
+		environmentId: "",
+		applications: {},
+		services: {}
+	};
+}
 /**
 * Set application ID in state (mutates state)
 */
@@ -7412,12 +7692,13 @@ function restorable(history, index, current) {
 * `current`, and what was current becomes `previous`. Releasing what already
 * runs — a redeploy of the same digest — changes nothing.
 */
-function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+function recordRelease(state, appName, image, by, releasedAt = /* @__PURE__ */ new Date()) {
 	const releases = state.releases?.[appName];
 	if (releases && sameImage(releases.current, image)) return;
 	const entry = {
 		...image,
-		releasedAt: releasedAt.toISOString()
+		releasedAt: releasedAt.toISOString(),
+		releasedBy: by
 	};
 	const history = [entry, ...releases?.history ?? []].slice(0, 10);
 	const previous = releases?.current;
@@ -7865,6 +8146,422 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends GkmError {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends GkmError {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !isIPv6(ipv6)) throw new ServerAddressInvalid(stage, SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!isIPv4(ipv4)) throw new ServerAddressInvalid(stage, SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await lookup(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends GkmError {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -8257,14 +8954,9 @@ var DeployJournal = class DeployJournal {
 		this.version = version;
 		this.existed = existed;
 	}
-	/**
-	* The stage's journal — its stored state, or `initial` written as the
-	* stage's first state, so there is somewhere to record the very first
-	* resource before it is created.
-	*/
-	static async open(store, stage, initial) {
+	static async open(store, stage, initial, adopt = (stored) => stored) {
 		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
 		const state = initial();
 		const version = await store.write(stage, state, { expectedVersion: null });
 		return new DeployJournal(store, stage, state, {}, version, false);
@@ -8283,10 +8975,13 @@ var DeployJournal = class DeployJournal {
 			status: "pending"
 		});
 	}
-	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
 	async ready(entry, id) {
 		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id) return;
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
 		await this.put({
 			...entry,
 			status: "ready",
@@ -8331,6 +9026,17 @@ var DeployJournal = class DeployJournal {
 			...staleId ? { staleId } : {}
 		};
 	}
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
 	/** Writes the stage's state, keeping its resource records. */
 	async save() {
 		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -8348,6 +9054,138 @@ var DeployJournal = class DeployJournal {
 	}
 };
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
+	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await import("./secrets-DbPmAS4k.mjs").then((n) => n.n);
+	const { composeStack } = await import("./stack-Co4uZkAo.mjs").then((n) => n.c);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	return stackHosts(composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	}));
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const server = serverAddress(stage, (await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		const changes = await applyStackDns(plan, {
+			...options.dryRun ? { dryRun: true } : {},
+			log,
+			credentials: {
+				env: options.env ?? process.env,
+				...options.home ? { home: options.home } : {},
+				log
+			},
+			...options.providerFor ? { providerFor: options.providerFor } : {}
+		});
+		if (options.journal && !options.dryRun) {
+			const providers = new Map(plan.domains.map((domain) => [domain.domain, domain.provider]));
+			await recordDnsChanges(options.journal, changes, (domain) => providers.get(domain));
+		}
+		return {
+			mode: "records",
+			hosts,
+			changes
+		};
+	} catch (error) {
+		if (error instanceof MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/providers/aws.ts
 /**
 * The AWS account a provider provisions in — the stage's, found the way the
@@ -9319,7 +10157,7 @@ async function provisionStage(options) {
 	});
 	const lock = dryRun ? void 0 : await stateStore.lock(stage, { operation: "provision" });
 	try {
-		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => createEmptyState(stage, "", "")));
+		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
 		const writeSecrets = async (values) => {
 			if (dryRun) return;
 			const stored = await secretsStore.read(stage) ?? initStageSecrets(stage);
@@ -9534,6 +10372,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { externalServices as $, LOCAL_LOGS_EMAIL as $n, isImageBuild as $t, setApplicationId as A, prepareEntryCredentials as An, applyPolicies as At, StateStoreWithoutLocking as B, applicationName as Bn, appEnvKeys as Bt, orchestrateDns as C, createCredentialsPreload as Cn, redisService as Ct, getGeneratedSecret as D, loadEnvFiles as Dn, LOCAL_CA_PATH as Dt, getBackupState as E, isPortAvailable as En, withRedisPassword as Et, createDnsProvider as F, FileSecretsStore as Fn, quoteIdentifier as Ft, AllowDevServicesTakesNoValue as G, markerOf as Gn, localRolePassword as Gt, contentVersion as H, imageName as Hn, networkEnv as Ht, DocumentStateStore as I, getKeyPath as In, LEGACY_LOCAL_LOGIN as It, ExternalServicesNotConfigured as J, initStageSecrets as Jn, TURBO_VERSION as Jt, DEV_SERVICES as K, ownershipMarker as Kn, composeBuildPaths as Kt, StageStateMissing as L, keystoreProject as Ln, ensurePostgresLogin as Lt, setGeneratedSecret as M, secretsStoreFor as Mn, bucketPolicies as Mt, setPostgresBackupId as N, storeFromConfig as Nn, postgresDatabaseNames as Nt, recordRelease as O, loadPortState as On, forgetState as Ot, DnsRecordsUnreadable as P, store_exports as Pn, postgresStatements as Pt, devServicesUsed as Q, withCustomSecret as Qn, imageBuildCredentials as Qt, StateLocked as R, projectKey as Rn, bucketClient as Rt, normalizeDnsConfig as S, primaryPortKey as Sn, STACK_CACHE as St, createEmptyState as T, findAvailablePort as Tn, stackRedis as Tt, createStateStore as U, imageRef as Un, workerEnvKeys as Ut, StateVersionConflict as V, deployIdentity as Vn, dockerfileOf as Vt, newLockHolder as W, isOwnedBy as Wn, envFor as Wt, assertDevServicesFlag as X, storage_exports as Xn, detectPackageManager as Xt, STORAGE_KEY_PAIR as Y, maskPassword as Yn, WORKER_PORT as Yt, assertExternalServices as Z, toEmbeddableSecrets as Zn, findBuildRoot as Zt, workerDockerfile as _, DEFAULT_IMAGES as _n, loadLocalCredentials as _t, provisionStage as a, composeFor as an, NoDomainForStage as ar, WorkerGenerator as at, extractSubdomain as b, portKeys as bn, withGeneratedSecrets as bt, StageProviderDisabled as c, planFor as cn, QueueGenerator as ct, stageProviderNotes as d, appTelemetry as dn, backendsOf as dt, cacheBackendFor as en, LOGS_SERVICE as er, manifestServiceDeclarations as et, DockerBuildFailed as f, isTelemetryKey as fn, constructGlobs as ft, ensureDockerignore as g, usesTelemetry as gn, LOCAL_RABBITMQ_USER as gt, dockerCommand as h, telemetryOf as hn, workspace_exports as ht, assertNoStaleSecrets as i, CLUSTER_DATABASE as in, withLogsPassword as ir, workerUnits as it, setBackupState as j, isRemoteStore as jn, applyPostgres as jt, recordRollback as k, loadSecretsForApp as kn, applyBuckets as kt, assertStageProvidersEnabled as l, resourceName as ln, CronGenerator as lt, appDockerfile as m, surfaceClientTraced as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, providerOf as nn, logsService as nr, requiredStageKeys as nt, verifyStageProviders as o, EMULATOR_ACCESS_KEY_ID as on, isMainFrontendApp as or, workerBundleName as ot, DockerPushFailed as p, scopeTelemetryEnv as pn, derivedContainers as pt, DevServicesNeedServerTarget as q, projectName as qn, imageLayout as qt, reportPlannedSeeds as r, storageBackendFor as rn, stackLogs as rr, suppliedOnly as rt, DeployJournal as s, TELEMETRY_CONTAINER as sn, resolveHost as sr, workerEntryDir as st, DeploySeedsFailed as t, eventsBackendFor as tn, logsAccess as tr, reportDevServices as tt, provisionCommand as u, hostFor as un, FAKE_ENV as ut, workerDockerfileOf as v, describeServices as vn, postgresSuperuser as vt, verifyDnsRecords as w, createEntryWrapper as wn, runsRedis as wt, findRootDomain as x, portsOf as xn, REDIS_SERVICE as xt, validateImageRef as y, fakeKey as yn, readLocalCredentials as yt, StateStoreBusy as z, readKey as zn, pgClient as zt };
+export { contentVersion as $, projectKey as $n, bucketClient as $t, orchestrateDns as A, telemetryOf as An, workspace_exports as At, setBackupState as B, findAvailablePort as Bn, stackRedis as Bt, HostNotPointingAtServer as C, planFor as Cn, QueueGenerator as Ct, serverAddressHint as D, isTelemetryKey as Dn, constructGlobs as Dt, requiredServerAddress as E, appTelemetry as En, backendsOf as Et, getBackupState as F, portKeys as Fn, withGeneratedSecrets as Ft, LocalStateInCi as G, prepareEntryCredentials as Gn, applyPolicies as Gt, setPostgresBackupId as H, loadEnvFiles as Hn, LOCAL_CA_PATH as Ht, getGeneratedSecret as I, portsOf as In, REDIS_SERVICE as It, StateStoreBusy as J, storeFromConfig as Jn, postgresDatabaseNames as Jt, StageStateMissing as K, isRemoteStore as Kn, applyPostgres as Kt, recordRelease as L, primaryPortKey as Ln, STACK_CACHE as Lt, asDokployState as M, DEFAULT_IMAGES as Mn, loadLocalCredentials as Mt, createComposeState as N, describeServices as Nn, postgresSuperuser as Nt, stackHosts as O, scopeTelemetryEnv as On, derivedContainers as Ot, createEmptyState as P, fakeKey as Pn, readLocalCredentials as Pt, assertStateOutlivesRun as Q, keystoreProject as Qn, ensurePostgresLogin as Qt, recordRollback as R, createCredentialsPreload as Rn, redisService as Rt, validateImageRef as S, TELEMETRY_CONTAINER as Sn, resolveHost as Sr, workerEntryDir as St, isLocalHost as T, hostFor as Tn, FAKE_ENV as Tt, DnsRecordsUnreadable as U, loadPortState as Un, forgetState as Ut, setGeneratedSecret as V, isPortAvailable as Vn, withRedisPassword as Vt, DocumentStateStore as W, loadSecretsForApp as Wn, applyBuckets as Wt, StateVersionConflict as X, FileSecretsStore as Xn, quoteIdentifier as Xt, StateStoreWithoutLocking as Y, store_exports as Yn, postgresStatements as Yt, appendHistory as Z, getKeyPath as Zn, LEGACY_LOCAL_LOGIN as Zt, appDockerfile as _, providerOf as _n, logsService as _r, requiredStageKeys as _t, provisionStage as a, envFor as an, isOwnedBy as ar, describeActor as at, workerDockerfile as b, composeFor as bn, NoDomainForStage as br, WorkerGenerator as bt, deploysWithCompose as c, imageLayout as cn, projectName as cr, DevServicesNeedServerTarget as ct, StageProviderDisabled as d, detectPackageManager as dn, storage_exports as dr, assertDevServicesFlag as dt, pgClient as en, readKey as er, createStateStore as et, assertStageProvidersEnabled as f, findBuildRoot as fn, toEmbeddableSecrets as fr, assertExternalServices as ft, DockerPushFailed as g, eventsBackendFor as gn, logsAccess as gr, reportDevServices as gt, DockerBuildFailed as h, cacheBackendFor as hn, LOGS_SERVICE as hr, manifestServiceDeclarations as ht, assertNoStaleSecrets as i, workerEnvKeys as in, imageRef as ir, currentActor as it, verifyDnsRecords as j, usesTelemetry as jn, LOCAL_RABBITMQ_USER as jt, systemLookup as k, surfaceClientTraced as kn, reconcileWorkspace as kt, provisionStageDns as l, TURBO_VERSION as ln, initStageSecrets as lr, ExternalServicesNotConfigured as lt, stageProviderNotes as m, isImageBuild as mn, LOCAL_LOGS_EMAIL as mr, externalServices as mt, reportDatabaseRuns as n, dockerfileOf as nn, deployIdentity as nr, upgradeV2State as nt, verifyStageProviders as o, localRolePassword as on, markerOf as or, AllowDevServicesTakesNoValue as ot, provisionCommand as p, imageBuildCredentials as pn, withCustomSecret as pr, devServicesUsed as pt, StateLocked as q, secretsStoreFor as qn, bucketPolicies as qt, reportPlannedSeeds as r, networkEnv as rn, imageName as rr, dnsResources as rt, assertStageServer as s, composeBuildPaths as sn, ownershipMarker as sr, DEV_SERVICES as st, DeploySeedsFailed as t, appEnvKeys as tn, applicationName as tr, newLockHolder as tt, DeployJournal as u, WORKER_PORT as un, maskPassword as ur, STORAGE_KEY_PAIR as ut, dockerCommand as v, storageBackendFor as vn, stackLogs as vr, suppliedOnly as vt, checkStackDns as w, resourceName as wn, CronGenerator as wt, workerDockerfileOf as x, EMULATOR_ACCESS_KEY_ID as xn, isMainFrontendApp as xr, workerBundleName as xt, ensureDockerignore as y, CLUSTER_DATABASE as yn, withLogsPassword as yr, workerUnits as yt, setApplicationId as z, createEntryWrapper as zn, runsRedis as zt };
 
-//# sourceMappingURL=seeds-CvGQJnPO.mjs.map
+//# sourceMappingURL=seeds-BSL55F6q.mjs.map