@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.93

package/dist/{seeds-BKoJYsE7.cjs → seeds-c-ByX9je.cjs}

@@ -7,7 +7,7 @@ const require_workspace = require("./workspace-CHOB2Xg3.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
-const require_resolve = require("./resolve-DUp65SnJ.cjs");
+const require_resolve = require("./resolve-g8htuR80.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -6950,6 +6950,126 @@ function reportDevServices(ctx, uses) {
 	}
 }
 //#endregion
+//#region src/deploy/actor.ts
+/**
+* Who wrote a stage's deploy state: a GitHub Actions run, or a person at a
+* machine. Recorded on every state write (`updatedBy`), on every resource
+* record and on every release (`releasedBy`), so "who put this here" has an
+* answer that does not depend on anyone's memory.
+*/
+/** Whether `env` is a CI job — GitHub Actions or any runner that sets `CI`. */
+function isCi(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" || env.CI === "true";
+}
+/** Who this process is writing as. */
+function currentActor(env = process.env) {
+	if (env.GITHUB_ACTIONS === "true") {
+		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+		return {
+			kind: "github",
+			actor: env.GITHUB_ACTOR ?? "unknown",
+			run: `${server}/${env.GITHUB_REPOSITORY ?? "unknown"}/actions/runs/${env.GITHUB_RUN_ID ?? "unknown"}`,
+			...env.GITHUB_WORKFLOW ? { workflow: env.GITHUB_WORKFLOW } : {}
+		};
+	}
+	let user = "unknown";
+	try {
+		user = (0, node_os.userInfo)().username;
+	} catch {}
+	return {
+		kind: "local",
+		user,
+		host: (0, node_os.hostname)()
+	};
+}
+/** `octocat (deploy, https://github.com/…/runs/1)` or `ada@laptop`. */
+function describeActor(actor) {
+	if (!actor) return "unknown";
+	if (actor.kind === "local") return `${actor.user}@${actor.host}`;
+	return `${actor.actor} (${actor.workflow ? `${actor.workflow}, ` : ""}${actor.run})`;
+}
+//#endregion
+//#region src/deploy/dnsResources.ts
+/** The resource type of a DNS record gkm wrote. */
+const DNS_RECORD_RESOURCE = "dns-record";
+/** A record's full name: `api.example.com`, or the domain for `@`. */
+function dnsRecordFqdn(domain, name) {
+	return name === "@" || name === "" ? domain : `${name}.${domain}`;
+}
+/** `dns-record:<fqdn>:<type>` */
+function dnsResourceKey(fqdn, type) {
+	return `${DNS_RECORD_RESOURCE}:${fqdn.toLowerCase()}:${type.toUpperCase()}`;
+}
+/** The resource record a written DNS record is kept as. */
+function dnsRecordResource(record) {
+	const fqdn = dnsRecordFqdn(record.domain, record.name).toLowerCase();
+	const type = record.type.toUpperCase();
+	const data = {
+		domain: record.domain,
+		name: record.name,
+		value: record.value,
+		ttl: record.ttl,
+		...record.provider ? { provider: record.provider } : {}
+	};
+	return {
+		key: dnsResourceKey(fqdn, type),
+		type: DNS_RECORD_RESOURCE,
+		id: `${fqdn} ${type}`,
+		status: "ready",
+		data
+	};
+}
+/** Records that gkm wrote `record` — or updates the value it holds. */
+async function recordDnsResource(journal, record) {
+	const { key, type, id, data } = dnsRecordResource(record);
+	await journal.ready({
+		key,
+		type,
+		...data ? { data } : {}
+	}, id);
+}
+/** Forgets a DNS record gkm deleted. */
+async function forgetDnsResource(journal, record) {
+	await journal.forget(dnsResourceKey(dnsRecordFqdn(record.domain, record.name), record.type));
+}
+/**
+* The changes a DNS step made, kept: what it created, updated or wrote is
+* recorded, what it deleted is forgotten. A record it found already right is
+* recorded only if gkm wrote it before; one it left to a person is not.
+*/
+async function recordDnsChanges(journal, changes, providerOf) {
+	for (const change of changes) {
+		if (change.action === "delete") {
+			await forgetDnsResource(journal, change);
+			continue;
+		}
+		const written = change.action === "create" || change.action === "update" || change.action === "write";
+		const known = change.action === "unchanged" && journal.record(dnsResourceKey(dnsRecordFqdn(change.domain, change.name), change.type)) !== void 0;
+		if (!written && !known || change.value === void 0) continue;
+		const provider = providerOf(change.domain);
+		await recordDnsResource(journal, {
+			domain: change.domain,
+			name: change.name,
+			type: change.type,
+			value: change.value,
+			ttl: change.ttl ?? 0,
+			...provider ? { provider } : {}
+		});
+	}
+}
+/** Every DNS record gkm wrote for the stage, from its resource records. */
+function dnsResources(resources) {
+	return Object.values(resources).filter((record) => record.type === DNS_RECORD_RESOURCE).map((record) => {
+		const data = record.data ?? {};
+		const [fqdn = "", type = ""] = (record.id ?? "").split(" ");
+		return {
+			...data,
+			type,
+			fqdn
+		};
+	}).sort((a, b) => a.fqdn.localeCompare(b.fqdn) || a.type.localeCompare(b.type));
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -6957,28 +7077,6 @@ function reportDevServices(ctx, uses) {
 function isStateProvider(value) {
 	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
 }
-//#endregion
-//#region src/deploy/StateStore.ts
-/**
-* Deploy state store.
-*
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
-*
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
-*/
 var StateLocked = class extends require_errors.GkmError {
 	stage;
 	holder;
@@ -7026,7 +7124,7 @@ var StateSchemaTooNew = class extends require_errors.GkmError {
 	stage;
 	schemaVersion;
 	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (3). Upgrade @geekmidas/cli to the version that wrote it.`);
 		this.stage = stage;
 		this.schemaVersion = schemaVersion;
 		this.name = "StateSchemaTooNew";
@@ -7061,6 +7159,22 @@ var UnknownStateProvider = class extends require_errors.GkmError {
 		this.name = "UnknownStateProvider";
 	}
 };
+/**
+* A deploy, setup or rollback of a stage in CI, with the stage's state kept on
+* the runner — which is discarded when the job ends.
+*/
+var LocalStateInCi = class extends require_errors.GkmError {
+	stage;
+	operation;
+	region;
+	constructor(stage, operation, region) {
+		super(`\`gkm ${operation}\` would keep stage '${stage}'s deploy state in .gkm/ on this CI runner, and the runner is discarded when the job ends: the next run would start without it — no releases to roll back to, no record of what was created. Keep the state in AWS — in gkm.config.ts:\n\n  state: { provider: 'ssm', region: '${region}' },\n\nthen move the state you already have, from the machine that holds it:\n\n  gkm state:push --stage ${stage}\n`);
+		this.stage = stage;
+		this.operation = operation;
+		this.region = region;
+		this.name = "LocalStateInCi";
+	}
+};
 /** A lock or write that could not get at the state backend in time. */
 var StateStoreBusy = class extends require_errors.GkmError {
 	stage;
@@ -7089,6 +7203,10 @@ function decodeDocument(stage, body, location) {
 		schemaVersion: 2,
 		document: parsed
 	};
+	if (schemaVersion === 3) return {
+		schemaVersion: 3,
+		document: parsed
+	};
 	throw new StateSchemaTooNew(stage, schemaVersion);
 }
 function encodeDocument(document) {
@@ -7128,6 +7246,79 @@ function migrateV1(stage, state) {
 		updatedAt: now
 	};
 }
+const isEmpty = (value) => !value || Object.keys(value).length === 0;
+/**
+* Whether a v2 state in the Dokploy shape was written by the compose target.
+*
+* Before v3 every target wrote the Dokploy shape, and compose filled none of
+* its Dokploy fields. So the rule is the shape's content, not the target the
+* workspace names now: a state whose every Dokploy-only field is empty — no
+* project or environment id, no application or service ids, no credentials,
+* generated secrets, backups or registry — holds nothing only Dokploy could
+* use, and reading it as compose loses nothing. One with any of them was
+* written by Dokploy and is kept exactly as it is.
+*
+* The configured target is not used: a document decodes the same wherever it
+* is read (`state:show`, `state:push`) without a workspace, a stage can be
+* moved between targets, and `--target` can override a run.
+*/
+function writtenByCompose(state) {
+	return !state.projectId && !state.environmentId && isEmpty(state.applications) && !state.services?.postgresId && !state.services?.redisId && isEmpty(state.appCredentials) && isEmpty(state.generatedSecrets) && !state.backups && !state.registryId;
+}
+/**
+* A v2 state and its records as v3 keeps them. A compose-written state
+* becomes the compose shape: its `dnsRecords` become `dns-record` resources,
+* and `dnsVerified` and the empty Dokploy fields go — the DNS check is made
+* on every deploy. A Dokploy state is returned as it is.
+*/
+function upgradeV2State(state, resources) {
+	if (!writtenByCompose(state)) return {
+		state,
+		resources
+	};
+	const compose = {
+		provider: "compose",
+		stage: state.stage,
+		lastDeployedAt: state.lastDeployedAt,
+		...state.identity ? { identity: state.identity } : {},
+		...state.releases ? { releases: state.releases } : {}
+	};
+	const upgraded = { ...resources };
+	for (const record of Object.values(state.dnsRecords ?? {})) {
+		const resource = migratedDnsResource(record);
+		upgraded[resource.key] = resource;
+	}
+	return {
+		state: compose,
+		resources: upgraded
+	};
+}
+/** A v2 `dnsRecords` entry as the `dns-record` resource v3 keeps. */
+function migratedDnsResource(record) {
+	return {
+		...dnsRecordResource({
+			domain: record.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		}),
+		updatedAt: record.createdAt
+	};
+}
+/** A v2 document as v3 — not written until the next write. */
+function migrateV2(document) {
+	const { state, resources } = upgradeV2State(document.state, document.resources);
+	return {
+		schemaVersion: 3,
+		stage: document.stage,
+		serial: document.serial,
+		state,
+		resources,
+		updatedAt: document.updatedAt,
+		history: []
+	};
+}
 function newLockHolder(options) {
 	let owner = "unknown";
 	try {
@@ -7146,14 +7337,33 @@ function contentVersion(body) {
 	return (0, node_crypto.createHash)("sha256").update(body).digest("hex").slice(0, 16);
 }
 /**
+* `history` with this write at its head. A run makes many writes — one per
+* resource it journals — so a run is one entry: a write by the run that
+* wrote the newest entry (the same lock) replaces it, and any other is
+* added. Without a lock, each write is its own entry.
+*/
+function appendHistory(history, entry, sameRun) {
+	return [entry, ...sameRun ? history.slice(1) : history].slice(0, 20);
+}
+/**
 * A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
+* stage, and create a lock object only if it does not exist. Migration,
+* resource records and history are the same for every such backend, so they
+* live here.
 */
 var DocumentStateStore = class {
+	/** The lock this store holds for each stage — what its writes are for. */
+	held = /* @__PURE__ */ new Map();
+	/** Per stage, the lock whose run wrote the newest history entry. */
+	logged = /* @__PURE__ */ new Map();
+	/** Who this store writes as. */
+	actor() {
+		return currentActor();
+	}
 	async lock(stage, options) {
 		const holder = newLockHolder(options);
 		await this.createLock(stage, holder);
+		this.held.set(stage, holder);
 		let released = false;
 		return {
 			stage,
@@ -7161,6 +7371,7 @@ var DocumentStateStore = class {
 			release: async () => {
 				if (released) return;
 				released = true;
+				if (this.held.get(stage)?.id === holder.id) this.held.delete(stage);
 				await this.removeLock(stage, holder);
 			}
 		};
@@ -7176,19 +7387,21 @@ var DocumentStateStore = class {
 		return {
 			state: current.document.state,
 			resources: current.document.resources,
+			history: current.document.history,
 			version: current.version
 		};
 	}
 	async write(stage, state, options) {
 		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
+			const document = this.stamp(stage, {
+				schemaVersion: 3,
 				stage,
 				serial: 1,
 				state,
 				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				history: []
+			});
 			return this.writeRaw(stage, encodeDocument(document), null);
 		}
 		return this.mutate(stage, options.expectedVersion, (document) => ({
@@ -7203,7 +7416,8 @@ var DocumentStateStore = class {
 				...document.resources,
 				[record.key]: {
 					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					updatedBy: this.actor()
 				}
 			}
 		}));
@@ -7217,6 +7431,25 @@ var DocumentStateStore = class {
 			};
 		});
 	}
+	/** `document` as this write leaves it: who wrote it, in its history. */
+	stamp(stage, document) {
+		const by = this.actor();
+		const holder = this.held.get(stage);
+		const operation = holder?.operation ?? "write";
+		const history = document.history ?? [];
+		const sameRun = holder !== void 0 && this.logged.get(stage) === holder.id && history[0]?.operation === operation;
+		if (holder) this.logged.set(stage, holder.id);
+		return {
+			...document,
+			updatedBy: by,
+			history: appendHistory(history, {
+				serial: document.serial,
+				at: document.updatedAt,
+				by,
+				operation
+			}, sameRun)
+		};
+	}
 	async mutate(stage, expectedVersion, change) {
 		const current = await this.readDocument(stage);
 		if (!current) {
@@ -7225,25 +7458,31 @@ var DocumentStateStore = class {
 		}
 		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
 		const next = change(current.document);
+		next.schemaVersion = 3;
 		next.serial = current.document.serial + 1;
 		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
+		return this.writeRaw(stage, encodeDocument(this.stamp(stage, next)), current.version);
 	}
 	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
+	* Reads the stage's document as v3. A v1 document is migrated in place on
+	* the way — itself a conditional write: if another run migrated (or wrote)
+	* first, its result is read instead. A v2 document is upgraded in memory
+	* and written as v3 by the next write.
 	*/
 	async readDocument(stage, attempt = 0) {
 		const raw = await this.readRaw(stage);
 		if (!raw) return null;
 		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
+		if (decoded.schemaVersion === 3) return {
 			document: decoded.document,
 			version: raw.version
 		};
+		if (decoded.schemaVersion === 2) return {
+			document: migrateV2(decoded.document),
+			version: raw.version
+		};
 		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
+		const document = this.stamp(stage, migrateV2(migrateV1(stage, decoded.state)));
 		try {
 			return {
 				document,
@@ -7255,6 +7494,22 @@ var DocumentStateStore = class {
 		}
 	}
 };
+/** Whether `config` keeps state on this machine — `local`, or none given. */
+function isLocalState(config) {
+	return !config || config.provider === "local";
+}
+/**
+* Refuses, with `LocalStateInCi`, a run that would write a deployed stage's
+* state to a CI runner's disk — the local stage, which runs on the runner
+* itself, is exempt. Local use is untouched. The region the message
+* suggests is the secrets store's, when the workspace keeps them in AWS.
+*/
+function assertStateOutlivesRun(workspace, stage, operation, env = process.env) {
+	if (stage === workspace.stages?.local) return;
+	if (!isCi(env) || !isLocalState(workspace.state)) return;
+	const store = workspace.secrets?.store;
+	throw new LocalStateInCi(stage, operation, typeof store === "object" && store && typeof store.region === "string" ? store.region : "<region>");
+}
 function isStateStore(value) {
 	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
 }
@@ -7271,17 +7526,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-BMfseje2.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-oX_zxj9V.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-CeEwayMB.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-BlYXQQSE.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-D9K62wM4.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-CaCtrzFL.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7291,7 +7546,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-BmMt2HhW.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-DeI7jtvi.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7339,7 +7594,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-CJwg2r_9.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-BZb-V14e.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7383,10 +7638,16 @@ var DnsProviderUnknown = class extends require_errors.GkmError {
 //#endregion
 //#region src/deploy/state.ts
 /**
-* Deploy state management for Dokploy deployments
+* A stage's deploy state.
+*
+* Every target records the same core — when the stage was last deployed, by
+* which identity, and each app's releases — and a target that keeps ids of
+* its own adds them in a shape of its own, told apart by `provider`:
 *
-* Stores resource IDs (applications, services) per stage to avoid
-* re-creating resources on subsequent deploys.
+* - `dokploy`: the project, applications, services and credentials Dokploy
+*   gave the stage, so a later deploy updates them rather than making more.
+* - `compose`: nothing beyond the core. A compose stage is one stack on one
+*   server; what it created elsewhere (DNS records) is a resource record.
 */
 /**
 * Create a new empty state for a stage
@@ -7402,6 +7663,31 @@ function createEmptyState(stage, projectId, environmentId) {
 		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
+/** A new compose stage's state. */
+function createComposeState(stage) {
+	return {
+		provider: "compose",
+		stage,
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* `state` as the Dokploy target keeps it. A stage whose state another target
+* wrote — one moved from compose to Dokploy — keeps its core (releases,
+* identity) and starts with no Dokploy ids, as a first deploy would.
+*/
+function asDokployState(state) {
+	if (state.provider === "dokploy") return state;
+	const { provider: _provider, ...core } = state;
+	return {
+		...core,
+		provider: "dokploy",
+		projectId: "",
+		environmentId: "",
+		applications: {},
+		services: {}
+	};
+}
 /**
 * Set application ID in state (mutates state)
 */
@@ -7421,12 +7707,13 @@ function restorable(history, index, current) {
 * `current`, and what was current becomes `previous`. Releasing what already
 * runs — a redeploy of the same digest — changes nothing.
 */
-function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+function recordRelease(state, appName, image, by, releasedAt = /* @__PURE__ */ new Date()) {
 	const releases = state.releases?.[appName];
 	if (releases && sameImage(releases.current, image)) return;
 	const entry = {
 		...image,
-		releasedAt: releasedAt.toISOString()
+		releasedAt: releasedAt.toISOString(),
+		releasedBy: by
 	};
 	const history = [entry, ...releases?.history ?? []].slice(0, 10);
 	const previous = releases?.current;
@@ -7874,6 +8161,422 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${require_workspace.SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends require_errors.GkmError {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === require_workspace.SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends require_errors.GkmError {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${require_workspace.SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${require_workspace.SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[require_workspace.SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[require_workspace.SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !(0, node_net.isIPv6)(ipv6)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!(0, node_net.isIPv4)(ipv4)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = require_workspace.cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${require_workspace.SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await (0, node_dns_promises.lookup)(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends require_errors.GkmError {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -8266,14 +8969,9 @@ var DeployJournal = class DeployJournal {
 		this.version = version;
 		this.existed = existed;
 	}
-	/**
-	* The stage's journal — its stored state, or `initial` written as the
-	* stage's first state, so there is somewhere to record the very first
-	* resource before it is created.
-	*/
-	static async open(store, stage, initial) {
+	static async open(store, stage, initial, adopt = (stored) => stored) {
 		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
 		const state = initial();
 		const version = await store.write(stage, state, { expectedVersion: null });
 		return new DeployJournal(store, stage, state, {}, version, false);
@@ -8292,10 +8990,13 @@ var DeployJournal = class DeployJournal {
 			status: "pending"
 		});
 	}
-	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
 	async ready(entry, id) {
 		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id) return;
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
 		await this.put({
 			...entry,
 			status: "ready",
@@ -8340,6 +9041,17 @@ var DeployJournal = class DeployJournal {
 			...staleId ? { staleId } : {}
 		};
 	}
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
 	/** Writes the stage's state, keeping its resource records. */
 	async save() {
 		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -8357,6 +9069,138 @@ var DeployJournal = class DeployJournal {
 	}
 };
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
+	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await Promise.resolve().then(() => require("./secrets-DJteijZo.cjs")).then((n) => n.secrets_exports);
+	const { composeStack } = await Promise.resolve().then(() => require("./stack-1PeLJS2j.cjs")).then((n) => n.stack_exports);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	return stackHosts(composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	}));
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const server = serverAddress(stage, (await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		const changes = await applyStackDns(plan, {
+			...options.dryRun ? { dryRun: true } : {},
+			log,
+			credentials: {
+				env: options.env ?? process.env,
+				...options.home ? { home: options.home } : {},
+				log
+			},
+			...options.providerFor ? { providerFor: options.providerFor } : {}
+		});
+		if (options.journal && !options.dryRun) {
+			const providers = new Map(plan.domains.map((domain) => [domain.domain, domain.provider]));
+			await recordDnsChanges(options.journal, changes, (domain) => providers.get(domain));
+		}
+		return {
+			mode: "records",
+			hosts,
+			changes
+		};
+	} catch (error) {
+		if (error instanceof require_credentials.MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/providers/aws.ts
 /**
 * The AWS account a provider provisions in — the stage's, found the way the
@@ -9328,7 +10172,7 @@ async function provisionStage(options) {
 	});
 	const lock = dryRun ? void 0 : await stateStore.lock(stage, { operation: "provision" });
 	try {
-		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => createEmptyState(stage, "", "")));
+		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
 		const writeSecrets = async (values) => {
 			if (dryRun) return;
 			const stored = await secretsStore.read(stage) ?? initStageSecrets(stage);
@@ -9639,6 +10483,12 @@ Object.defineProperty(exports, "FileSecretsStore", {
 		return FileSecretsStore;
 	}
 });
+Object.defineProperty(exports, "HostNotPointingAtServer", {
+	enumerable: true,
+	get: function() {
+		return HostNotPointingAtServer;
+	}
+});
 Object.defineProperty(exports, "LEGACY_LOCAL_LOGIN", {
 	enumerable: true,
 	get: function() {
@@ -9669,6 +10519,12 @@ Object.defineProperty(exports, "LOGS_SERVICE", {
 		return LOGS_SERVICE;
 	}
 });
+Object.defineProperty(exports, "LocalStateInCi", {
+	enumerable: true,
+	get: function() {
+		return LocalStateInCi;
+	}
+});
 Object.defineProperty(exports, "NoDomainForStage", {
 	enumerable: true,
 	get: function() {
@@ -9777,6 +10633,12 @@ Object.defineProperty(exports, "appTelemetry", {
 		return appTelemetry;
 	}
 });
+Object.defineProperty(exports, "appendHistory", {
+	enumerable: true,
+	get: function() {
+		return appendHistory;
+	}
+});
 Object.defineProperty(exports, "applicationName", {
 	enumerable: true,
 	get: function() {
@@ -9801,6 +10663,12 @@ Object.defineProperty(exports, "applyPostgres", {
 		return applyPostgres;
 	}
 });
+Object.defineProperty(exports, "asDokployState", {
+	enumerable: true,
+	get: function() {
+		return asDokployState;
+	}
+});
 Object.defineProperty(exports, "assertDevServicesFlag", {
 	enumerable: true,
 	get: function() {
@@ -9825,6 +10693,18 @@ Object.defineProperty(exports, "assertStageProvidersEnabled", {
 		return assertStageProvidersEnabled;
 	}
 });
+Object.defineProperty(exports, "assertStageServer", {
+	enumerable: true,
+	get: function() {
+		return assertStageServer;
+	}
+});
+Object.defineProperty(exports, "assertStateOutlivesRun", {
+	enumerable: true,
+	get: function() {
+		return assertStateOutlivesRun;
+	}
+});
 Object.defineProperty(exports, "backendsOf", {
 	enumerable: true,
 	get: function() {
@@ -9849,6 +10729,12 @@ Object.defineProperty(exports, "cacheBackendFor", {
 		return cacheBackendFor;
 	}
 });
+Object.defineProperty(exports, "checkStackDns", {
+	enumerable: true,
+	get: function() {
+		return checkStackDns;
+	}
+});
 Object.defineProperty(exports, "composeBuildPaths", {
 	enumerable: true,
 	get: function() {
@@ -9873,16 +10759,16 @@ Object.defineProperty(exports, "contentVersion", {
 		return contentVersion;
 	}
 });
-Object.defineProperty(exports, "createCredentialsPreload", {
+Object.defineProperty(exports, "createComposeState", {
 	enumerable: true,
 	get: function() {
-		return createCredentialsPreload;
+		return createComposeState;
 	}
 });
-Object.defineProperty(exports, "createDnsProvider", {
+Object.defineProperty(exports, "createCredentialsPreload", {
 	enumerable: true,
 	get: function() {
-		return createDnsProvider;
+		return createCredentialsPreload;
 	}
 });
 Object.defineProperty(exports, "createEmptyState", {
@@ -9903,18 +10789,36 @@ Object.defineProperty(exports, "createStateStore", {
 		return createStateStore;
 	}
 });
+Object.defineProperty(exports, "currentActor", {
+	enumerable: true,
+	get: function() {
+		return currentActor;
+	}
+});
 Object.defineProperty(exports, "deployIdentity", {
 	enumerable: true,
 	get: function() {
 		return deployIdentity;
 	}
 });
+Object.defineProperty(exports, "deploysWithCompose", {
+	enumerable: true,
+	get: function() {
+		return deploysWithCompose;
+	}
+});
 Object.defineProperty(exports, "derivedContainers", {
 	enumerable: true,
 	get: function() {
 		return derivedContainers;
 	}
 });
+Object.defineProperty(exports, "describeActor", {
+	enumerable: true,
+	get: function() {
+		return describeActor;
+	}
+});
 Object.defineProperty(exports, "describeServices", {
 	enumerable: true,
 	get: function() {
@@ -9933,6 +10837,12 @@ Object.defineProperty(exports, "devServicesUsed", {
 		return devServicesUsed;
 	}
 });
+Object.defineProperty(exports, "dnsResources", {
+	enumerable: true,
+	get: function() {
+		return dnsResources;
+	}
+});
 Object.defineProperty(exports, "dockerCommand", {
 	enumerable: true,
 	get: function() {
@@ -9975,12 +10885,6 @@ Object.defineProperty(exports, "externalServices", {
 		return externalServices;
 	}
 });
-Object.defineProperty(exports, "extractSubdomain", {
-	enumerable: true,
-	get: function() {
-		return extractSubdomain;
-	}
-});
 Object.defineProperty(exports, "fakeKey", {
 	enumerable: true,
 	get: function() {
@@ -9999,12 +10903,6 @@ Object.defineProperty(exports, "findBuildRoot", {
 		return findBuildRoot;
 	}
 });
-Object.defineProperty(exports, "findRootDomain", {
-	enumerable: true,
-	get: function() {
-		return findRootDomain;
-	}
-});
 Object.defineProperty(exports, "forgetState", {
 	enumerable: true,
 	get: function() {
@@ -10071,6 +10969,12 @@ Object.defineProperty(exports, "isImageBuild", {
 		return isImageBuild;
 	}
 });
+Object.defineProperty(exports, "isLocalHost", {
+	enumerable: true,
+	get: function() {
+		return isLocalHost;
+	}
+});
 Object.defineProperty(exports, "isMainFrontendApp", {
 	enumerable: true,
 	get: function() {
@@ -10179,12 +11083,6 @@ Object.defineProperty(exports, "newLockHolder", {
 		return newLockHolder;
 	}
 });
-Object.defineProperty(exports, "normalizeDnsConfig", {
-	enumerable: true,
-	get: function() {
-		return normalizeDnsConfig;
-	}
-});
 Object.defineProperty(exports, "orchestrateDns", {
 	enumerable: true,
 	get: function() {
@@ -10281,6 +11179,12 @@ Object.defineProperty(exports, "provisionStage", {
 		return provisionStage;
 	}
 });
+Object.defineProperty(exports, "provisionStageDns", {
+	enumerable: true,
+	get: function() {
+		return provisionStageDns;
+	}
+});
 Object.defineProperty(exports, "quoteIdentifier", {
 	enumerable: true,
 	get: function() {
@@ -10341,6 +11245,12 @@ Object.defineProperty(exports, "reportPlannedSeeds", {
 		return reportPlannedSeeds;
 	}
 });
+Object.defineProperty(exports, "requiredServerAddress", {
+	enumerable: true,
+	get: function() {
+		return requiredServerAddress;
+	}
+});
 Object.defineProperty(exports, "requiredStageKeys", {
 	enumerable: true,
 	get: function() {
@@ -10377,6 +11287,12 @@ Object.defineProperty(exports, "secretsStoreFor", {
 		return secretsStoreFor;
 	}
 });
+Object.defineProperty(exports, "serverAddressHint", {
+	enumerable: true,
+	get: function() {
+		return serverAddressHint;
+	}
+});
 Object.defineProperty(exports, "setApplicationId", {
 	enumerable: true,
 	get: function() {
@@ -10401,6 +11317,12 @@ Object.defineProperty(exports, "setPostgresBackupId", {
 		return setPostgresBackupId;
 	}
 });
+Object.defineProperty(exports, "stackHosts", {
+	enumerable: true,
+	get: function() {
+		return stackHosts;
+	}
+});
 Object.defineProperty(exports, "stackLogs", {
 	enumerable: true,
 	get: function() {
@@ -10455,6 +11377,12 @@ Object.defineProperty(exports, "surfaceClientTraced", {
 		return surfaceClientTraced;
 	}
 });
+Object.defineProperty(exports, "systemLookup", {
+	enumerable: true,
+	get: function() {
+		return systemLookup;
+	}
+});
 Object.defineProperty(exports, "telemetryOf", {
 	enumerable: true,
 	get: function() {
@@ -10467,6 +11395,12 @@ Object.defineProperty(exports, "toEmbeddableSecrets", {
 		return toEmbeddableSecrets;
 	}
 });
+Object.defineProperty(exports, "upgradeV2State", {
+	enumerable: true,
+	get: function() {
+		return upgradeV2State;
+	}
+});
 Object.defineProperty(exports, "usesTelemetry", {
 	enumerable: true,
 	get: function() {
@@ -10558,4 +11492,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-BKoJYsE7.cjs.map
+//# sourceMappingURL=seeds-c-ByX9je.cjs.map