@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.94

package/dist/index.mjs

@@ -1,26 +1,26 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { n as isGkmError, t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { _ as storeDokployCredentials, d as getDokployRegistryId, f as getDokployToken, g as removeGoDaddyCredentials, h as removeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as readCredentials, o as DEFAULT_TIMEOUT_MS, t as MissingCredential, u as getDokployCredentials, v as storeGoDaddyToken, y as storeHostingerToken } from "./credentials-C4KII3PD.mjs";
+import { _ as storeDokployCredentials, d as getDokployRegistryId, f as getDokployToken, g as removeGoDaddyCredentials, h as removeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as readCredentials, o as DEFAULT_TIMEOUT_MS, u as getDokployCredentials, v as storeGoDaddyToken, y as storeHostingerToken } from "./credentials-DpfnUvIR.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-Bzw7Zs82.mjs";
+import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-DWK1PTXP.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $n as LOCAL_LOGS_EMAIL, $t as isImageBuild, An as prepareEntryCredentials, Cn as createCredentialsPreload, Dn as loadEnvFiles, Dt as LOCAL_CA_PATH, En as isPortAvailable, Fn as FileSecretsStore, Ft as quoteIdentifier, In as getKeyPath, Mn as secretsStoreFor, Nt as postgresDatabaseNames, On as loadPortState, Ot as forgetState, Qn as withCustomSecret, Qt as imageBuildCredentials, Rn as projectKey, Sn as primaryPortKey, Tn as findAvailablePort, U as createStateStore, Vn as deployIdentity, X as assertDevServicesFlag, Yn as maskPassword, Zn as toEmbeddableSecrets, a as provisionStage, at as WorkerGenerator, ct as QueueGenerator, dn as appTelemetry, dt as backendsOf$1, en as cacheBackendFor, ft as constructGlobs, h as dockerCommand, hn as telemetryOf, in as CLUSTER_DATABASE, it as workerUnits, kn as loadSecretsForApp, lt as CronGenerator, mn as surfaceClientTraced, mt as reconcileWorkspace, nn as providerOf, ot as workerBundleName, pn as scopeTelemetryEnv, pt as derivedContainers, sn as TELEMETRY_CONTAINER, st as workerEntryDir, tn as eventsBackendFor, u as provisionCommand, ut as FAKE_ENV, vn as describeServices, wn as createEntryWrapper, xn as portsOf, yn as fakeKey, yt as readLocalCredentials, zt as pgClient } from "./seeds-CvGQJnPO.mjs";
+import { Bn as prepareEntryCredentials, Cn as scopeTelemetryEnv, Ct as derivedContainers, Fn as findAvailablePort, Gn as FileSecretsStore, Gt as quoteIdentifier, Hn as secretsStoreFor, In as isPortAvailable, Jn as projectKey, Kn as getKeyPath, Ln as loadEnvFiles, Lt as LOCAL_CA_PATH, Mn as primaryPortKey, Nn as createCredentialsPreload, On as describeServices, Pn as createEntryWrapper, Rn as loadPortState, Rt as forgetState, St as constructGlobs, Tn as telemetryOf, Ut as postgresDatabaseNames, Yt as pgClient, Zn as deployIdentity, _ as describeActor, _n as TELEMETRY_CONTAINER, _t as workerEntryDir, ar as maskPassword, bt as FAKE_ENV, c as dockerCommand, cn as imageBuildCredentials, cr as withCustomSecret, dn as eventsBackendFor, fn as providerOf, gt as workerBundleName, ht as WorkerGenerator, jn as portsOf, kn as fakeKey, kt as readLocalCredentials, ln as isImageBuild, lr as LOCAL_LOGS_EMAIL, m as dnsResources, mn as CLUSTER_DATABASE, mt as workerUnits, sr as toEmbeddableSecrets, un as cacheBackendFor, vt as QueueGenerator, w as assertDevServicesFlag, wn as surfaceClientTraced, wt as reconcileWorkspace, xn as appTelemetry, xt as backendsOf$1, yt as CronGenerator, zn as loadSecretsForApp } from "./seeds-CTxTZa-R.mjs";
 import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
 import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-CTaWrA_L.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as LocalSandbox } from "./local-Otp74ak0.mjs";
-import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BTtGAtm3.mjs";
-import { t as deploy$1 } from "./deploy-yuJHlkY0.mjs";
-import { _ as planStackDns, a as stackOverrideFile, b as serverAddressHint, d as pinnedRef, f as edgeDir, g as applyStackDns, h as dockerCompose, i as ComposePushNeedsBuild, m as EDGE_PROJECT, o as composeProject, p as removeEdgeRoutes, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as parseDigests, v as requiredServerAddress, x as stackHosts, y as serverAddress } from "./compose-CTdVeeVk.mjs";
+import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
+import { T as keyFingerprint, n as sniffAppEnvironment, o as DokployApi, y as createStateStore } from "./sniffer-DCcuzHz_.mjs";
+import { t as deploy$1 } from "./deploy-CeJ5D0xn.mjs";
+import { a as stackOverrideFile, c as dockerCompose, i as ComposePushNeedsBuild, o as edgeDir, r as ComposePinNeedsPull, s as removeEdgeRoutes, t as composeTarget } from "./compose-D2RFYd_f.mjs";
+import { d as parseDigests, h as EDGE_PROJECT, i as composeProject, p as pinnedRef, s as stackDir } from "./stack-NrdH5ngX.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJFvfkaz.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-Y8XHdoCR.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-BSaS2535.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import "./awsStore-BWa1KNY-.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-naOSJpeJ.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -49,7 +49,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.92";
+var version = "10.0.0-alpha.94";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -132,7 +132,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-BTtGAtm3.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-DCcuzHz_.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -208,7 +208,7 @@ async function loginCommand(options) {
 * Store a GoDaddy Personal Access Token. Not validated: the only call that
 * proves a token without a domain is an account call (`GET /v1/domains`),
 * which a token scoped to `domains.dns:update` alone may not make — the first
-* `gkm setup` that writes a record is where a bad token reports itself.
+* deploy that writes a record is where a bad token reports itself.
 */
 async function loginGoDaddy(options) {
 	logger$8.log("\n🔐 Logging in to GoDaddy...\n");
@@ -229,7 +229,7 @@ async function loginGoDaddy(options) {
 	logger$8.log("\n✓ GoDaddy token stored.");
 	logger$8.log(`  Token: ${maskToken(token)}`);
 	logger$8.log(`  Credentials stored in: ${getCredentialsPath(where)}`);
-	logger$8.log("  Not validated here: proving a token without a domain needs an account\n  scope a DNS-only token does not have, so the first gkm setup that\n  writes a record is where a bad token reports itself.");
+	logger$8.log("  Not validated here: proving a token without a domain needs an account\n  scope a DNS-only token does not have, so the first deploy that\n  writes a record is where a bad token reports itself.");
 	logger$8.log("\nYou can now use it as a DNS provider without setting GODADDY_API_TOKEN.");
 }
 /**
@@ -2326,9 +2326,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BSbZ7-9n.mjs");
+		const { prepareDevDatabases } = await import("./migrate-DhvFPGLi.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BSbZ7-9n.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-DhvFPGLi.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3381,7 +3381,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-C-AdesaG.mjs");
+			const { bundleServer } = await import("./bundler-BSHog8CH.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3526,7 +3526,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-C-AdesaG.mjs");
+		const { bundleServer } = await import("./bundler-BSHog8CH.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3612,7 +3612,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-C-AdesaG.mjs");
+			const { bundleServer } = await import("./bundler-BSHog8CH.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3906,7 +3906,11 @@ async function composeCommand(options, deps = {}) {
 		...options.dryRun ? { dryRun: true } : {},
 		...options.push ? { buildOnly: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
-		...options.skipDnsCheck ? { skipDnsCheck: true } : {},
+		...options.skipDns ? { skipDns: true } : {},
+		...options.resourcesOnly ? { resourcesOnly: true } : {},
+		...options.skipResources ? { skipResources: true } : {},
+		...options.rotateKeys ? { rotateKeys: true } : {},
+		...options.retireOldKeys ? { retireOldKeys: true } : {},
 		logger: {
 			info: (message) => console.log(message),
 			warn: (message) => console.warn(message),
@@ -4133,6 +4137,7 @@ const MASKED = "********";
 */
 function maskStateSecrets(state) {
 	const masked = structuredClone(state);
+	if (masked.provider !== "dokploy") return masked;
 	for (const credentials of Object.values(masked.appCredentials ?? {})) credentials.dbPassword = MASKED;
 	for (const secrets of Object.values(masked.generatedSecrets ?? {})) for (const name of Object.keys(secrets)) secrets[name] = MASKED;
 	if (masked.backups) {
@@ -4188,6 +4193,7 @@ async function stateShowCommand(options) {
 	if (options.json) console.log(JSON.stringify(state, null, 2));
 	else {
 		printStateDetails(state);
+		printDnsRecords(stored.resources);
 		printUnfinished(stored.resources);
 	}
 }
@@ -4232,8 +4238,8 @@ async function stateDiffCommand(options) {
 	if (!remote) console.log("Remote: (none)");
 	else console.log(`Remote: Last deployed ${remote.lastDeployedAt}`);
 	console.log("");
-	const localApps = local?.applications ?? {};
-	const remoteApps = remote?.applications ?? {};
+	const localApps = dokploy(local)?.applications ?? {};
+	const remoteApps = dokploy(remote)?.applications ?? {};
 	const allApps = /* @__PURE__ */ new Set([...Object.keys(localApps), ...Object.keys(remoteApps)]);
 	if (allApps.size > 0) {
 		console.log("Applications:");
@@ -4246,8 +4252,8 @@ async function stateDiffCommand(options) {
 			else console.log(`  ${app}: ${localId} (local) != ${remoteId} (remote) [MISMATCH]`);
 		}
 	}
-	const localServices = local?.services ?? {};
-	const remoteServices = remote?.services ?? {};
+	const localServices = dokploy(local)?.services ?? {};
+	const remoteServices = dokploy(remote)?.services ?? {};
 	if (Object.keys(localServices).length > 0 || Object.keys(remoteServices).length > 0) {
 		console.log("\nServices:");
 		const serviceKeys = /* @__PURE__ */ new Set([...Object.keys(localServices), ...Object.keys(remoteServices)]);
@@ -4312,6 +4318,10 @@ async function copyStage(from, to, stage) {
 	for (const { updatedAt: _stamped, ...record } of Object.values(source.resources)) version = await to.putResource(stage, record, { expectedVersion: version });
 	return source;
 }
+/** `state` if Dokploy wrote it — the only shape with ids of its own. */
+function dokploy(state) {
+	return state?.provider === "dokploy" ? state : null;
+}
 function describeRecord(record) {
 	if (!record) return "(none)";
 	return record.id ? `${record.status} ${record.id}` : record.status;
@@ -4325,6 +4335,12 @@ function printUnfinished(resources) {
 	for (const record of pending) console.log(`  ${record.key}`);
 }
 function printStateSummary(state) {
+	if (state.provider !== "dokploy") {
+		console.log(`  Stage: ${state.stage} (${state.provider})`);
+		console.log(`  Apps released: ${Object.keys(state.releases ?? {}).length}`);
+		console.log(`  Last deployed: ${state.lastDeployedAt}`);
+		return;
+	}
 	const appCount = Object.keys(state.applications).length;
 	const hasPostgres = !!state.services.postgresId;
 	const hasRedis = !!state.services.redisId;
@@ -4335,6 +4351,14 @@ function printStateSummary(state) {
 	console.log(`  Last deployed: ${state.lastDeployedAt}`);
 }
 function printStateDetails(state) {
+	if (state.provider !== "dokploy") {
+		console.log(`Stage: ${state.stage} (${state.provider})`);
+		console.log(`Last Deployed: ${state.lastDeployedAt}`);
+		if (state.identity) console.log(`Identity: ${state.identity}`);
+		console.log("");
+		printReleases(state.releases);
+		return;
+	}
 	console.log(`Stage: ${state.stage}`);
 	console.log(`Environment ID: ${state.environmentId}`);
 	console.log(`Last Deployed: ${state.lastDeployedAt}`);
@@ -4376,6 +4400,62 @@ function printStateDetails(state) {
 		for (const [hostname, info] of Object.entries(state.dnsVerified)) console.log(`  ${hostname}: ${info.serverIp} (${info.verifiedAt})`);
 	}
 }
+/** Each app's current release, and who released it. */
+function printReleases(releases) {
+	console.log("Releases:");
+	const apps = Object.entries(releases ?? {});
+	if (apps.length === 0) {
+		console.log("  (none)");
+		return;
+	}
+	for (const [app, { current }] of apps) console.log(`  ${app}: ${describeRelease(current)}`);
+}
+/** `ghcr.io/acme/api:v2 (sha256:…) · 2026-… · ada@laptop` */
+function describeRelease(release) {
+	return [
+		`${release.ref}${release.digest ? ` (${release.digest})` : ""}`,
+		release.releasedAt,
+		describeActor(release.releasedBy)
+	].join(" · ");
+}
+/** The DNS records gkm wrote for the stage. */
+function printDnsRecords(resources) {
+	const records = dnsResources(resources);
+	if (records.length === 0) return;
+	console.log("");
+	console.log("DNS Records:");
+	for (const record of records) console.log(`  ${record.fqdn} ${record.type} ${record.value} (TTL ${record.ttl}${record.provider ? `, ${record.provider}` : ""})`);
+}
+/**
+* Who wrote a stage's state, newest first, and what each app runs.
+* `gkm state:history --stage=<stage>`
+*/
+async function stateHistoryCommand(options) {
+	const { workspace } = await loadWorkspaceConfig();
+	const stored = await (await createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	})).read(options.stage);
+	if (!stored) {
+		console.log(`No state found for stage: ${options.stage}`);
+		return;
+	}
+	const history = {
+		stage: options.stage,
+		history: stored.history,
+		releases: Object.fromEntries(Object.entries(stored.state.releases ?? {}).map(([app, releases]) => [app, releases.current]))
+	};
+	if (options.json) {
+		console.log(JSON.stringify(history, null, 2));
+		return;
+	}
+	console.log(`History of stage ${options.stage} (newest first):`);
+	if (history.history.length === 0) console.log("  (none recorded)");
+	for (const entry of history.history) console.log(`  ${entry.serial} · ${entry.at} · ${describeActor(entry.by)} · ${entry.operation}`);
+	console.log("");
+	printReleases(stored.state.releases);
+}
 //#endregion
 //#region src/secrets/generator.ts
 /**
@@ -5347,25 +5427,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.92",
-	"@geekmidas/auth": "~10.0.0-alpha.92",
-	"@geekmidas/cache": "~10.0.0-alpha.92",
-	"@geekmidas/client": "~10.0.0-alpha.92",
-	"@geekmidas/cloud": "~10.0.0-alpha.92",
-	"@geekmidas/constructs": "~10.0.0-alpha.92",
-	"@geekmidas/db": "~10.0.0-alpha.92",
-	"@geekmidas/emailkit": "~10.0.0-alpha.92",
-	"@geekmidas/envkit": "~10.0.0-alpha.92",
-	"@geekmidas/errors": "~10.0.0-alpha.92",
-	"@geekmidas/events": "~10.0.0-alpha.92",
-	"@geekmidas/logger": "~10.0.0-alpha.92",
-	"@geekmidas/manifest": "~10.0.0-alpha.92",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.92",
-	"@geekmidas/schema": "~10.0.0-alpha.92",
-	"@geekmidas/services": "~10.0.0-alpha.92",
-	"@geekmidas/storage": "~10.0.0-alpha.92",
-	"@geekmidas/telescope": "~10.0.0-alpha.92",
-	"@geekmidas/testkit": "~10.0.0-alpha.92",
+	"@geekmidas/audit": "~10.0.0-alpha.94",
+	"@geekmidas/auth": "~10.0.0-alpha.94",
+	"@geekmidas/cache": "~10.0.0-alpha.94",
+	"@geekmidas/client": "~10.0.0-alpha.94",
+	"@geekmidas/cloud": "~10.0.0-alpha.94",
+	"@geekmidas/constructs": "~10.0.0-alpha.94",
+	"@geekmidas/db": "~10.0.0-alpha.94",
+	"@geekmidas/emailkit": "~10.0.0-alpha.94",
+	"@geekmidas/envkit": "~10.0.0-alpha.94",
+	"@geekmidas/errors": "~10.0.0-alpha.94",
+	"@geekmidas/events": "~10.0.0-alpha.94",
+	"@geekmidas/logger": "~10.0.0-alpha.94",
+	"@geekmidas/manifest": "~10.0.0-alpha.94",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.94",
+	"@geekmidas/schema": "~10.0.0-alpha.94",
+	"@geekmidas/services": "~10.0.0-alpha.94",
+	"@geekmidas/storage": "~10.0.0-alpha.94",
+	"@geekmidas/telescope": "~10.0.0-alpha.94",
+	"@geekmidas/testkit": "~10.0.0-alpha.94",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5766,7 +5846,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "446c06603533dd304ee5655661784b7a4f07e2b7", version = cliVersion()) {
+function stagesActionUses(commit = "dcab6fe1ee033518c7901452ee9c49102749c9ed", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -6018,6 +6098,7 @@ function stagesJob(options) {
       has-build: \${{ steps.stages.outputs.has-build }}
       has-deploy: \${{ steps.stages.outputs.has-deploy }}
       aws-region: \${{ steps.stages.outputs.aws-region }}
+      resources: \${{ steps.stages.outputs.resources }}
     steps:
       - uses: actions/checkout@v4
 
@@ -6035,6 +6116,10 @@ ${pm.setup}
           stage: \${{ inputs.stage }}
 `;
 }
+/** Every step in `steps` run only when `condition` holds. */
+function onlyIf(steps, condition) {
+	return steps.replace(/^ {6}- /gm, `      - if: ${condition}\n        `);
+}
 /**
 * The registry login a compose build pushes with: GitHub's own token on
 * ghcr.io, otherwise a username variable and a password secret.
@@ -6059,6 +6144,11 @@ function registryLogin(registry) {
 *   `ref` — then that commit's push build, whose digests pin each image. Over
 *   SSH, with a pinned host key, the server checks the commit out and runs
 *   `gkm compose` on exactly those images.
+* - Resources: where the stage has some the deploy creates — a provider's
+*   bucket and key, DNS records through a provider — the runner creates them
+*   first (`gkm deploy --resources-only`) with the stage's role and the DNS
+*   token from its environment, and the server deploys with
+*   `--skip-resources`: neither credential reaches the server.
 */
 function composeDeploy(options) {
 	const pm = tooling(options);
@@ -6134,6 +6224,13 @@ ${registryLogin(registry)}
     permissions:
       contents: read
       actions: read
+      id-token: write
+    env:
+      # Whether the stage has resources the deploy creates — a provider's
+      # bucket and key (deploy.<kind>.<stage>), DNS records through a provider
+      # in dns: the runner creates them with the stage's role and DNS token,
+      # so neither reaches the server, which deploys with --skip-resources.
+      RESOURCES_ON_RUNNER: \${{ contains(fromJSON(needs.stages.outputs.resources || '[]'), matrix.stage) }}
     steps:
       # A release deploys its tag's commit, never its target_commitish — the
       # branch it was drafted against, which has moved on since.
@@ -6156,6 +6253,40 @@ ${registryLogin(registry)}
           REF: \${{ inputs.ref }}
           SHA: \${{ github.sha }}
 
+      # The deploy's resources, here on the runner: each provider's bucket
+      # and key (written into the stage's secrets store), and every public
+      # host's DNS record — a new app's included, one per host, never a
+      # wildcard — written through the provider where it is missing or out of
+      # date and read back from it. The stage's secrets (GKM_SERVER_IPV4
+      # among them) are read with the stage's role; the DNS token is a secret
+      # on this stage's environment. A missing credential fails here, before
+      # anything is deployed.
+      - name: Check out the commit
+        if: env.RESOURCES_ON_RUNNER == 'true'
+        uses: actions/checkout@v4
+        with:
+          ref: \${{ steps.commit.outputs.sha }}
+
+${onlyIf(pm.setup, "env.RESOURCES_ON_RUNNER == 'true'")}
+      - name: Install
+        if: env.RESOURCES_ON_RUNNER == 'true'
+        run: ${pm.install}
+
+      - name: Assume the stage's AWS role
+        if: env.RESOURCES_ON_RUNNER == 'true' && needs.stages.outputs.aws-region != ''
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: \${{ vars.AWS_ROLE_ARN }}
+          aws-region: \${{ needs.stages.outputs.aws-region }}
+
+      - name: Create the stage's resources
+        if: env.RESOURCES_ON_RUNNER == 'true'
+        run: ${pm.exec} gkm deploy --stage "$STAGE" --resources-only
+        env:
+          STAGE: \${{ matrix.stage }}
+          GODADDY_API_TOKEN: \${{ secrets.GODADDY_API_TOKEN }}
+          HOSTINGER_API_TOKEN: \${{ secrets.HOSTINGER_API_TOKEN }}
+
       # The push run of this workflow that built the commit for this stage:
       # this run on a push, the newest one with the stage's digests otherwise.
       - name: Find the commit's push build
@@ -6217,9 +6348,9 @@ ${registryLogin(registry)}
           if [ -f digests.json ]; then digests=$(base64 -w0 < digests.json); fi
           ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \\
             "$DEPLOY_USER@$DEPLOY_HOST" \\
-            "bash -s -- $(printf '%q ' "$STAGE" "$SHA" "$DEPLOY_PATH" "$digests")" <<'REMOTE'
+            "bash -s -- $(printf '%q ' "$STAGE" "$SHA" "$DEPLOY_PATH" "$digests" "$RESOURCES_ON_RUNNER")" <<'REMOTE'
           set -euo pipefail
-          stage=$1 sha=$2 dir=$3 digests=$4
+          stage=$1 sha=$2 dir=$3 digests=$4 resources_on_runner=$5
           cd "$dir"
           git fetch --quiet origin
           git checkout --quiet --detach "$sha"
@@ -6230,6 +6361,8 @@ ${registryLogin(registry)}
             printf '%s' "$digests" | base64 -d > ".gkm/digests-$stage.json"
             args+=(--digests-file ".gkm/digests-$stage.json")
           fi
+          # Created and confirmed from the runner already.
+          if [ "$resources_on_runner" = true ]; then args+=(--skip-resources); fi
           ${pm.exec} gkm compose "\${args[@]}"
           REMOTE
         env:
@@ -6278,7 +6411,9 @@ function targetDeploy(options) {
 `;
 	const deployEnv = sst ? "" : `
           DOKPLOY_API_TOKEN: \${{ secrets.DOKPLOY_API_TOKEN }}
-          DOKPLOY_ENDPOINT: \${{ vars.DOKPLOY_ENDPOINT }}`;
+          DOKPLOY_ENDPOINT: \${{ vars.DOKPLOY_ENDPOINT }}
+          GODADDY_API_TOKEN: \${{ secrets.GODADDY_API_TOKEN }}
+          HOSTINGER_API_TOKEN: \${{ secrets.HOSTINGER_API_TOKEN }}`;
 	return `${deployHeader(false)}
 jobs:
 ${stagesJob(options)}
@@ -11048,137 +11183,9 @@ function maskUrl(url) {
 	}
 }
 //#endregion
-//#region src/providers/dns.ts
-/** Whether the workspace deploys through the compose target. */
-function deploysWithCompose(workspace) {
-	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
-}
-/**
-* A compose stage that serves a domain has its server's address in its
-* secrets — checked before `gkm setup --stage` does anything else.
-*
-* @throws {ServerAddressMissing} for a compose stage with a domain and none
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function assertStageServer(workspace, stage, secrets) {
-	if (stage === workspace.stages.local) return void 0;
-	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
-	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
-}
-/**
-* The hosts a compose stage serves: its stack composed as a deploy would —
-* with the secrets it would generate made up in memory, never written — and
-* every route's host read off it.
-*/
-async function composeStageHosts(options) {
-	const { workspace, stage } = options;
-	const runnables = options.runnables ?? {};
-	const background = options.background ?? {};
-	const manifest = options.manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root,
-		runnables,
-		background
-	});
-	const stored = await (await secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	})).read(stage);
-	const { deployedStackSecrets } = await import("./compose-CTdVeeVk.mjs").then((n) => n.l);
-	const { composeStack } = await import("./compose-CTdVeeVk.mjs").then((n) => n.c);
-	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
-	const stack = composeStack({
-		workspace,
-		manifest,
-		runnables,
-		background,
-		stage,
-		identity: deployIdentity(workspace, stage),
-		images: {
-			mode: "pull",
-			tag: "dns",
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
-		},
-		secrets,
-		buildOnly: true,
-		allowDevServices: true
-	});
-	return stackHosts(stack);
-}
-/**
-* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
-* records, created or corrected. A dry run reads and prints, and writes
-* nothing.
-*/
-async function provisionStageDns(options) {
-	const { workspace, stage } = options;
-	const log = options.log ?? ((line) => console.log(line));
-	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
-		mode: "none",
-		hosts: [],
-		changes: []
-	};
-	const store = await secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	});
-	const server = serverAddress(stage, (await store.read(stage))?.custom);
-	if (!server) {
-		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
-		return {
-			mode: "none",
-			hosts: [],
-			changes: []
-		};
-	}
-	const hosts = [...options.hosts ?? await composeStageHosts({
-		workspace,
-		stage,
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {},
-		...options.manifest ? { manifest: options.manifest } : {},
-		...options.runnables ? { runnables: options.runnables } : {},
-		...options.background ? { background: options.background } : {}
-	})];
-	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
-	const plan = planStackDns({
-		stage,
-		hosts,
-		server,
-		dns: workspace.dns
-	});
-	try {
-		return {
-			mode: "records",
-			hosts,
-			changes: await applyStackDns(plan, {
-				...options.dryRun ? { dryRun: true } : {},
-				log,
-				credentials: {
-					env: options.env ?? process.env,
-					...options.home ? { home: options.home } : {},
-					log
-				},
-				...options.providerFor ? { providerFor: options.providerFor } : {}
-			})
-		};
-	} catch (error) {
-		if (error instanceof MissingCredential) {
-			log(`   ⚠ ${error.message}`);
-			log("   Until then, create these records yourself:");
-			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
-			return {
-				mode: "records",
-				hosts,
-				changes: []
-			};
-		}
-		throw error;
-	}
-}
-//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ __exportAll({
+	SetupIsLocal: () => SetupIsLocal,
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
 	ensureStageSecrets: () => ensureStageSecrets,
 	reconcileSecrets: () => reconcileSecrets,
@@ -11186,14 +11193,21 @@ var setup_exports = /* @__PURE__ */ __exportAll({
 });
 const logger$1 = console;
 /**
-* Converge a stage on what its constructs declare.
-*
-* The local stage: its secrets (local → the stage's store → generated) and
-* the containers on this machine. A deployed stage: its secrets, and then
-* every provider `deploy.<kind>.<stage>` names — the bucket, user and key an
-* `objects: { provider: 's3' }` stage is backed by — created or repaired in
-* the stage's own account. A deployed stage's infrastructure is not on this
-* machine, so no container is started for one.
+* `gkm setup --stage <deployed stage>`: setup is this machine's, done once,
+* and creates nothing for a deployed stage — the deploy does.
+*/
+var SetupIsLocal = class extends GkmError {
+	stage;
+	constructor(stage) {
+		super(`gkm setup sets up this machine — its secrets and its containers — and '${stage}' is a deployed stage: nothing of it is set up from here. The deploy creates what '${stage}' needs — its buckets and keys, its DNS records — every time it runs: gkm deploy --stage ${stage} (gkm compose --stage ${stage} is the same deploy). Its --dry-run prints what it would create.`);
+		this.stage = stage;
+		this.name = "SetupIsLocal";
+	}
+};
+/**
+* Set this machine up for the workspace, once: the local stage's secrets
+* (local → the stage's store → generated) and its containers. A deployed
+* stage is refused with {@link SetupIsLocal}: its resources are the deploy's.
 */
 async function setupCommand(options = {}) {
 	let loadedConfig;
@@ -11205,24 +11219,15 @@ async function setupCommand(options = {}) {
 	}
 	const stage = options.stage ?? loadedConfig.workspace.stages.local;
 	const { workspace } = loadedConfig;
-	const local = stage === workspace.stages.local;
-	logger$1.log(local ? "\n🔧 Setting up the local environment...\n" : `\n☁️  Provisioning the '${stage}' stage${options.dryRun ? " (dry run)" : ""}...\n`);
+	if (workspace.stages.deployed.includes(stage)) throw new SetupIsLocal(stage);
+	logger$1.log("\n🔧 Setting up the local environment...\n");
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
-	if (!local) assertStageServer(workspace, stage, await (await secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
-	if (!local && options.dryRun) {
-		await provisionDeployed(workspace, stage, options);
-		return;
-	}
 	if (!await resolveSecrets(stage, workspace, options)) {
 		logger$1.error("❌ Failed to resolve secrets. Exiting.");
 		process.exit(1);
 	}
-	if (!local) {
-		await provisionDeployed(workspace, stage, options);
-		return;
-	}
 	if (!options.skipDocker) {
 		logger$1.log("");
 		await reconcileLocal(workspace, stage, options);
@@ -11230,33 +11235,6 @@ async function setupCommand(options = {}) {
 	printSummary(workspace, stage);
 }
 /**
-* A deployed stage's providers: each one's `ensure()`, in the stage's own
-* account, its keys written into the stage's secrets.
-*/
-async function provisionDeployed(workspace, stage, options) {
-	logger$1.log(options.dryRun ? `\n☁️  Providers for '${stage}' (dry run — nothing is created or written)` : `\n☁️  Providers for '${stage}'`);
-	const configured = (await provisionStage({
-		workspace,
-		stage,
-		...options.dryRun ? { dryRun: true } : {},
-		...options.profile ? { profile: options.profile } : {},
-		...options.rotateKeys ? { rotateKeys: true } : {},
-		...options.retireOldKeys ? { retireOldKeys: true } : {},
-		log: (line) => logger$1.log(line)
-	})).filter((r) => r.mode === "provider");
-	if (configured.length === 0) logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${provisionCommand(stage)} create it.`);
-	const dns = await provisionStageDns({
-		workspace,
-		stage,
-		...options.dryRun ? { dryRun: true } : {},
-		...options.profile ? { profile: options.profile } : {},
-		log: (line) => logger$1.log(line)
-	});
-	const changes = configured.reduce((n, r) => n + r.actions.length, 0) + dns.changes.filter((c) => c.action !== "unchanged" && c.action !== "manual").length;
-	if (configured.length === 0 && dns.mode === "none") return;
-	logger$1.log(options.dryRun ? `\n${changes === 0 ? "✅ Nothing to change" : `📋 ${changes} change${changes === 1 ? "" : "s"} planned`}` : `\n✅ '${stage}' provisioned${changes === 0 ? " — already up to date" : ` (${changes} change${changes === 1 ? "" : "s"})`}`);
-}
-/**
 * Converge this machine on what the manifest declares.
 *
 * Says what it did in one line and stays silent when it did nothing, because
@@ -11281,7 +11259,7 @@ async function reconcileLocal(workspace, stage, options) {
 /**
 * Resolve secrets with priority:
 * 1. Local secrets exist → use them (preserves manual additions)
-* 2. A deployed stage whose store has secrets → pull and use
+* 2. The stage's store has secrets → use them
 * 3. Neither → generate fresh secrets
 *
 * --force skips checks 1 and 2 and always regenerates.
@@ -11608,7 +11586,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BSbZ7-9n.mjs");
+	const { migrateAndSeed } = await import("./migrate-DhvFPGLi.mjs");
 	const { discover } = await import("./discover-qjFapetL.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11962,7 +11940,7 @@ program.command("trust").description("Trust the local edge's certificate authori
 		exitWithError(error);
 	}
 });
-program.command("setup").description("Reconcile declared constructs — locally, containers and secrets; on a deployed stage, its providers (deploy.objects)").option("--stage <stage>", "Stage name (default: stages.local)").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").option("--dry-run", "A deployed stage: print what its providers would create or change, and write nothing").option("--profile <profile>", "AWS profile for the stage's account").option("--rotate-keys", "A deployed stage: issue each provisioned key a successor (the old one is deleted after the next deploy)").option("--retire-old-keys", "A deployed stage: delete a rotated-out key now instead of after the next deploy").action(async (options) => {
+program.command("setup").description("Set this machine up for the workspace, once: the local stage's secrets and containers. A deployed stage's resources are created by its deploy").option("--stage <stage>", "Stage name (default: stages.local); never a deployed stage").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12044,7 +12022,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BSbZ7-9n.mjs");
+		const { migrateCommand } = await import("./migrate-DhvFPGLi.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12057,7 +12035,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BSbZ7-9n.mjs");
+		const { seedCommand } = await import("./migrate-DhvFPGLi.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12070,7 +12048,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BSbZ7-9n.mjs");
+		const { migrationCommand } = await import("./migrate-DhvFPGLi.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12116,7 +12094,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		exitWithError(error);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Deployed stage: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Deployed stage: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--resources-only", "Deployed stage: create its resources — deploy.<kind>.<stage> providers' buckets and keys, and its DNS records — and nothing else (a CI runner, before the server deploys)").option("--skip-resources", "Deployed stage: an earlier --resources-only run created its resources; run no provider and write or check no DNS record").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12170,7 +12148,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-2Opn2VVE.mjs");
+		const { secretsAddCommand } = await import("./add-C85isXFl.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12180,7 +12158,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-C9Jm9dfn.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-_4qKqtTx.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12190,7 +12168,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-C9Jm9dfn.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-_4qKqtTx.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12228,8 +12206,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-Dh1Jk7WE.mjs");
-		const { secretsStoreFor } = await import("./seeds-CvGQJnPO.mjs").then((n) => n.Pn);
+		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
+		const { secretsStoreFor } = await import("./seeds-CTxTZa-R.mjs").then((n) => n.Wn);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12238,7 +12216,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-CvGQJnPO.mjs").then((n) => n.ht);
+		const { derivedContainers } = await import("./seeds-CTxTZa-R.mjs").then((n) => n.Tt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12255,14 +12233,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-IZsYyZ5F.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-B7evHv7O.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
-	const { deployCli } = await import("./cli-BjhaVObS.mjs");
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--resources-only", "Deployed stage: create its resources — deploy.<kind>.<stage> providers' buckets and keys, and its DNS records — and nothing else (a CI runner, before the server deploys)").option("--skip-resources", "Deployed stage: an earlier --resources-only run created its resources; run no provider and write or check no DNS record").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
+	const { deployCli } = await import("./cli-BsFenyaf.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12274,14 +12252,18 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		...options.dryRun ? { dryRun: true } : {},
 		...options.atomic ? { atomic: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
-		...options.skipDnsCheck ? { skipDnsCheck: true } : {}
+		...options.skipDns ? { skipDns: true } : {},
+		...options.resourcesOnly ? { resourcesOnly: true } : {},
+		...options.skipResources ? { skipResources: true } : {},
+		...options.rotateKeys ? { rotateKeys: true } : {},
+		...options.retireOldKeys ? { retireOldKeys: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-D1d-fW0r.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-Dtd6BZX9.mjs");
+		const { rollbackStage } = await import("./rollback-NroNbGC0.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-DAHs2Zko.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12314,7 +12296,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-B1k42hIt.mjs");
+		const { deployGithubCommand } = await import("./github-xsDT19im.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12324,7 +12306,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-DY-fQKmo.mjs");
+		const { stagesCommand } = await import("./stages-veC4TcQe.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12423,6 +12405,15 @@ program.command("state:show").description("Show deployment state for a stage").r
 		exitWithError(error);
 	}
 });
+program.command("state:history").description("Show who wrote a stage's deploy state, newest first, and what each app runs").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--json", "Output as JSON").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await stateHistoryCommand(options);
+	} catch (error) {
+		exitWithError(error);
+	}
+});
 program.command("state:unlock").description("Release a stage deploy lock left behind by a run that crashed").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -12457,6 +12448,6 @@ try {
 }
 program.parse();
 //#endregion
-export { formatError as a, prompt as c, stamp as i, generateFullstackCustomSecrets as n, validateDokployToken as o, slug as r, canPrompt as s, deploysWithCompose as t };
+export { validateDokployToken as a, formatError as i, slug as n, canPrompt as o, stamp as r, prompt as s, generateFullstackCustomSecrets as t };
 
 //# sourceMappingURL=index.mjs.map