@geekmidas/cli 10.0.0-alpha.93 → 10.0.0-alpha.95

package/dist/{seeds-BSL55F6q.mjs → seeds-CoKkrSny.mjs}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { r as storedCredentials, s as run$1, t as MissingCredential, x as gkmHome } from "./credentials-C4KII3PD.mjs";
+import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, ot as cnameTarget, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-Bzw7Zs82.mjs";
+import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DWK1PTXP.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
-import { c as runtimeOf } from "./resolve-Ccjlpnd9.mjs";
+import { c as runtimeOf } from "./resolve-DakDhr6Z.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -16,9 +16,9 @@ import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
 import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
-import { createServer, isIPv4, isIPv6 } from "node:net";
+import { createServer } from "node:net";
 import { execFile, spawn } from "node:child_process";
-import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
 import { config } from "dotenv";
 import { stringify } from "yaml";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
@@ -31,7 +31,6 @@ import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/clie
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
-import * as s3Url from "@geekmidas/storage/s3-url";
 //#region src/workspace/rootSite.ts
 /**
 * Which site the base domain points at — deployed and locally alike.
@@ -4924,7 +4923,7 @@ function bucketPolicies(plan) {
 * client, can be admitted by the policy where the client would have said no.
 * Prefer `**` where crossing segments is what you meant.
 */
-function bucketPolicy$1(bucket, open) {
+function bucketPolicy(bucket, open) {
 	return JSON.stringify({
 		Version: "2012-10-17",
 		Statement: [{
@@ -5006,7 +5005,7 @@ async function databasesExist(client, names) {
 async function applyPolicies(client, policies) {
 	const applied = [];
 	for (const { bucket, open } of policies) {
-		const wanted = bucketPolicy$1(bucket, open);
+		const wanted = bucketPolicy(bucket, open);
 		const describe = `open paths on ${bucket}`;
 		if (equivalent(await client.policy(bucket), wanted)) {
 			applied.push({
@@ -6646,1295 +6645,385 @@ function isUnder(file, dir) {
 	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel) ? !rel.startsWith(`..${sep}`) : false;
 }
 //#endregion
-//#region src/deploy/devServices.ts
+//#region src/target/dokploy/dns/DnsProvider.ts
 /**
-* Mail and object storage on a deployed stage: real ones, or — only when
-* someone asked — the dev services the local stage runs.
-*
-* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
-* nobody has to configure either. Deployed, the same two containers would be
-* a stage that silently delivers no mail and keeps its files on one
-* container's disk. So a deployed stage on a server target takes both from
-* its secrets — the mail server's URL and sending address, and each bucket's
-* URL — and a stage missing any of them fails before anything is built,
-* provisioned or written, naming every key at once.
-*
-* A bucket's credentials are not checked: they are optional, and come from
-* either of two places. The bucket's URL may carry a key of its own
-* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
-* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
-* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
-*
-* `--allow-dev-services` is the way out for a stage that is not production —
-* a preview, a demo: every construct the stage does not account for gets the
-* dev service the local stage runs for it — a bucket MinIO, mail Mailpit —
-* and the target derives the keys from it. What the stage does account for
-* still wins: a key set in its secrets, or a provider (`deploy.objects`)
-* that backs the kind. Every run that uses one says so, loudly.
-*
-* Pure: what each target runs is decided here from declarations and the
-* stage's values, and the targets do the running.
+* Check if value is a DnsProvider implementation.
 */
+function isDnsProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
+}
 /**
-* The dev services a deployed stage can run — one per kind that has one on
-* every server target: a bucket's MinIO and mail's Mailpit. A cache or a
-* database is not here because a server stage runs its own anyway.
+* Create a DNS provider based on configuration.
+*
+* - 'hostinger': HostingerProvider
+* - 'route53': Route53Provider
+* - 'godaddy': GoDaddyProvider
+* - 'manual': Returns null (user handles DNS)
+* - Custom: Use provided DnsProvider implementation
 */
-const DEV_SERVICES = ["minio", "mailpit"];
+async function createDnsProvider(options) {
+	const { config } = options;
+	if (config.provider === "manual") return null;
+	if (isDnsProvider(config.provider)) return config.provider;
+	const provider = config.provider;
+	if (provider === "hostinger") {
+		const { HostingerProvider } = await import("./HostingerProvider-BNpS9aRJ.mjs");
+		return new HostingerProvider(options.hostinger);
+	}
+	if (provider === "route53") {
+		const { Route53Provider } = await import("./Route53Provider-QXxjkZO1.mjs");
+		const route53Config = config;
+		return new Route53Provider({
+			region: route53Config.region,
+			profile: route53Config.profile,
+			hostedZoneId: route53Config.hostedZoneId
+		});
+	}
+	if (provider === "godaddy") {
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-BwW51hPm.mjs");
+		return new GoDaddyProvider(options.godaddy ?? {});
+	}
+	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
+	throw new DnsProviderUnknown(config);
+}
 /**
-* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
-* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
-* this pair when the stage set it, or with whatever else the SDK's default
-* chain finds — a role.
+* The provider's credentials can write records and not read them — a key
+* scoped to updates only. What reads them falls back to writing every record,
+* which is idempotent, without a diff.
 */
-const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
-/** Dev services asked of a target that runs no containers. */
-var DevServicesNeedServerTarget = class extends GkmError {
-	target;
-	constructor(target) {
-		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services.`);
-		this.target = target;
-		this.name = "DevServicesNeedServerTarget";
+var DnsRecordsUnreadable = class extends GkmError {
+	provider;
+	domain;
+	reason;
+	constructor(provider, domain, reason) {
+		super(`The ${provider} key cannot read ${domain}'s DNS records (${reason}), so changes cannot be compared with what is there: every record is written, which leaves one that already has its value as it was.`);
+		this.provider = provider;
+		this.domain = domain;
+		this.reason = reason;
+		this.name = "DnsRecordsUnreadable";
 	}
 };
-/**
-* `--allow-dev-services` given a value — the list it used to take. It is a
-* switch now: every construct the stage does not account for gets its dev
-* service.
-*/
-var AllowDevServicesTakesNoValue = class extends GkmError {
-	value;
-	constructor(value) {
-		super(`--allow-dev-services takes no value (it was given '${value}'). It runs the dev service for every bucket and mail the stage does not account for — no key in its secrets, no provider in deploy.<kind>.<stage> — so there is nothing to list. Pass --allow-dev-services on its own.`);
-		this.value = value;
-		this.name = "AllowDevServicesTakesNoValue";
+/** A DNS provider gkm names and does not have yet. */
+var DnsProviderNotImplemented = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The ${provider} DNS provider is not implemented yet. Use 'route53', 'godaddy', 'hostinger' or 'manual' for this domain in dns, or pass your own DnsProvider object.`);
+		this.provider = provider;
+		this.name = "DnsProviderNotImplemented";
+	}
+};
+/** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
+var DnsProviderUnknown = class extends GkmError {
+	config;
+	constructor(config) {
+		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
+		this.config = config;
+		this.name = "DnsProviderUnknown";
 	}
 };
+//#endregion
+//#region src/deploy/state.ts
 /**
-* Refuses `--allow-dev-services <value>` and `--allow-dev-services=<value>` on
-* a command line, with the reason, before the parser calls the value an
-* excess argument. `gkm deploy` and `gkm compose` take no positional
-* argument, so whatever follows the flag and is not a flag was meant for it.
-*
-* @throws {AllowDevServicesTakesNoValue}
+* Create a new empty state for a stage
 */
-function assertDevServicesFlag(argv) {
-	for (let i = 0; i < argv.length; i++) {
-		const arg = argv[i];
-		if (arg.startsWith("--allow-dev-services=")) throw new AllowDevServicesTakesNoValue(arg.slice(arg.indexOf("=") + 1));
-		const next = argv[i + 1];
-		if (arg === "--allow-dev-services" && next && !next.startsWith("-")) throw new AllowDevServicesTakesNoValue(next);
-	}
+function createEmptyState(stage, projectId, environmentId) {
+	return {
+		provider: "dokploy",
+		stage,
+		projectId,
+		environmentId,
+		applications: {},
+		services: {},
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/** A new compose stage's state. */
+function createComposeState(stage) {
+	return {
+		provider: "compose",
+		stage,
+		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
 }
 /**
-* A deployed stage with mail or object storage that its secrets do not
-* configure — every missing key, across every app, at once.
+* `state` as the Dokploy target keeps it. A stage whose state another target
+* wrote — one moved from compose to Dokploy — keeps its core (releases,
+* identity) and starts with no Dokploy ids, as a first deploy would.
 */
-var ExternalServicesNotConfigured = class extends GkmError {
-	stage;
-	missing;
-	constructor(stage, missing) {
-		const standIns = missing.some((m) => m.service !== void 0);
-		const lines = missing.map((m) => {
-			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
-			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "") + (m.hint ? `\n      ${m.hint}` : "");
-		});
-		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\n` + (standIns ? "For a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.\n\n" : "") + `Or run: gkm secrets:add --stage ${stage}`);
-		this.stage = stage;
-		this.missing = missing;
-		this.name = "ExternalServicesNotConfigured";
-	}
-};
+function asDokployState(state) {
+	if (state.provider === "dokploy") return state;
+	const { provider: _provider, ...core } = state;
+	return {
+		...core,
+		provider: "dokploy",
+		projectId: "",
+		environmentId: "",
+		applications: {},
+		services: {}
+	};
+}
 /**
-* Every mail and storage construct a manifest declares, with the apps that
-* depend on each — what a target that provisions the whole manifest checks.
+* Set application ID in state (mutates state)
 */
-function manifestServiceDeclarations(manifest) {
-	return Object.entries(manifest).flatMap(([id, declaration]) => {
-		const { kind } = declaration;
-		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
-		const apps = dependentsOf(manifest, id).filter((caller) => {
-			const callerKind = manifest[caller]?.kind;
-			return callerKind === "rest-api" || callerKind === "site";
-		}).map(appKey);
-		return [{
-			id,
-			kind,
-			...declaration.kind === "file-server" ? { of: declaration.of } : {},
-			...apps.length ? { apps } : {}
-		}];
-	});
+function setApplicationId(state, appName, applicationId) {
+	state.applications[appName] = applicationId;
+}
+/** Two records naming the same image: by digest when both have one. */
+function sameImage(a, b) {
+	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
+}
+/** The newest release in `history` after `index` that a rollback may restore. */
+function restorable(history, index, current) {
+	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
 }
 /**
-* Every key a stage must be given rather than derive — the one list both a
-* deploy's checks and `gkm secrets:add` read, so what a deploy refuses and
-* what the builder offers cannot drift.
-*
-* - Deployed, mail is its URL and its sending address, a bucket its URL, and
-*   a file server its public URL. Locally all of it is Mailpit and MinIO.
-* - On every stage, a third party's credentials: nobody but the third party
-*   can issue them.
-*
-* Never a derived value: a database URL, a generated secret, the seed.
+* Record that `image` went live for `appName` (mutates state): it becomes
+* `current`, and what was current becomes `previous`. Releasing what already
+* runs — a redeploy of the same digest — changes nothing.
 */
-function requiredStageKeys(input) {
-	const domain = input.domain ?? "example.com";
-	const keys = [];
-	const add = (entry) => {
-		if (!keys.some((k) => k.key === entry.key)) keys.push(entry);
+function recordRelease(state, appName, image, by, releasedAt = /* @__PURE__ */ new Date()) {
+	const releases = state.releases?.[appName];
+	if (releases && sameImage(releases.current, image)) return;
+	const entry = {
+		...image,
+		releasedAt: releasedAt.toISOString(),
+		releasedBy: by
+	};
+	const history = [entry, ...releases?.history ?? []].slice(0, 10);
+	const previous = releases?.current;
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current: entry,
+			...previous ? { previous } : {},
+			history
+		}
 	};
-	const byId = (list) => [...list ?? []].sort((a, b) => a.id.localeCompare(b.id));
-	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
-	if (!input.local) {
-		const services = byId(input.services);
-		const objects = input.providers?.objects;
-		const storage = objects?.accounted ? objects.hint ? { hint: objects.hint } : {} : { service: "minio" };
-		for (const d of services.filter((d) => d.kind === "email")) {
-			add({
-				key: provideKey(d.id, "url"),
-				id: d.id,
-				kind: "email",
-				what: `where '${d.id}' sends mail — any SMTP server`,
-				example: `smtp://user:password@smtp.${domain}:587`,
-				service: "mailpit",
-				...apps(d)
-			});
-			add({
-				key: provideKey(d.id, "from"),
-				id: d.id,
-				kind: "email",
-				what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
-				example: `noreply@${domain}`,
-				service: "mailpit",
-				...apps(d)
-			});
-		}
-		for (const d of services.filter((d) => d.kind === "objects")) add({
-			key: provideKey(d.id, "url"),
-			id: d.id,
-			kind: "bucket",
-			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
-			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
-			example: `s3://${appKey(d.id)}?region=eu-west-1`,
-			...storage,
-			...apps(d)
-		});
-		for (const d of services.filter((d) => d.kind === "file-server")) add({
-			key: provideKey(d.id, "url"),
-			id: d.id,
-			kind: "file-server",
-			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
-			example: `https://${appKey(d.id)}.${domain}`,
-			...storage,
-			...d.of ? { of: d.of } : {},
-			...apps(d)
-		});
-	}
-	if (!input.local && input.server) add({
-		key: SERVER_IPV4_KEY,
-		id: "server",
-		kind: "server",
-		what: "the public IPv4 address of the server the stage's stack runs on — its hosts' DNS records point at it, and every deploy checks they do",
-		note: `${SERVER_IPV6_KEY} adds its IPv6 address (AAAA records); neither is ever handed to an app`,
-		example: "203.0.113.10"
-	});
-	for (const d of byId(input.credentials)) add({
-		key: provideKey(d.id, "credentials"),
-		id: d.id,
-		kind: d.kind,
-		what: d.kind === "external-api" ? `the credentials '${d.id}' was issued for this stage, as its schema describes them` : `the credential '${d.id}', as its schema describes it`,
-		example: "{\"apiKey\":\"…\"}",
-		...apps(d)
-	});
-	return keys;
 }
 /**
-* Whether only the stage's secrets can supply `key` to a construct of `kind`
-* — what nothing on the stage derives.
-*
-* A third party's credentials, always. Deployed, also each generated secret
-* and keyring: the stage generated each one once, and every run reads the
-* same value back.
+* Record that `appName` was rolled back to `to` (mutates state): every
+* release newer than it is marked rolled back, so neither this rollback nor
+* a later one restores it, and `previous` moves to the release before `to`.
 */
-function suppliedOnly(kind, id, key, local) {
-	if (kind === "credential") return true;
-	if (kind === "external-api") return key === provideKey(id, "credentials");
-	if (local) return false;
-	return kind === "secret" || kind === "encryption";
+function recordRollback(state, appName, to) {
+	const releases = state.releases?.[appName];
+	if (!releases) return;
+	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
+	if (index === -1) return;
+	const history = releases.history.map((entry, i) => i < index ? {
+		...entry,
+		rolledBack: true
+	} : entry);
+	const current = history[index];
+	const previous = restorable(history, index, current);
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current,
+			...previous ? { previous } : {},
+			history
+		}
+	};
 }
 /**
-* Where a deployed stage's mail and storage come from, and what it lacks.
-*
-* - Mail is external once its URL is set, and then needs its sending
-*   address too. Unset, it is Mailpit where allowed — the address derived
-*   unless set — and missing otherwise.
-* - A bucket is external once its URL is set; its credentials, in the URL or
-*   the shared pair, are optional. Unset, it is MinIO where allowed, and
-*   missing otherwise.
-* - A file server's URL is derived where its bucket is MinIO, unless set;
-*   over an external bucket the stage must set it.
-*
-* The keys themselves are {@link requiredStageKeys}'s.
+* Get a generated secret for an app
 */
-function externalServices(input) {
-	const { supplied, allow } = input;
-	const has = (key) => supplied[key] !== void 0;
-	const required = requiredStageKeys({
-		local: false,
-		services: input.declarations,
-		...input.domain ? { domain: input.domain } : {},
-		...input.providers ? { providers: input.providers } : {}
-	});
-	const standIn = (k) => allow && k.service !== void 0 && !has(k.key);
-	const mailpit = required.filter((k) => k.kind === "email" && k.key === provideKey(k.id, "url")).filter(standIn).map((k) => k.id);
-	const minio = required.filter((k) => k.kind === "bucket").filter(standIn).map((k) => k.id);
-	const covered = (k) => k.kind === "email" && mailpit.includes(k.id) || k.kind === "bucket" && minio.includes(k.id) || k.kind === "file-server" && k.of !== void 0 && minio.includes(k.of);
-	return {
-		missing: required.filter((k) => !has(k.key) && !covered(k)).map(({ key, id, what, note, example, service, apps, hint }) => ({
-			key,
-			id,
-			what,
-			...note ? { note } : {},
-			example,
-			...service ? { service } : {},
-			...apps ? { apps } : {},
-			...hint ? { hint } : {}
-		})),
-		minio,
-		mailpit
-	};
+function getGeneratedSecret(state, appName, secretName) {
+	return state?.generatedSecrets?.[appName]?.[secretName];
 }
 /**
-* `externalServices`, refusing a stage that lacks anything.
-*
-* @throws {ExternalServicesNotConfigured} naming every missing key
+* Set a generated secret for an app (mutates state)
 */
-function assertExternalServices(input) {
-	const services = externalServices(input);
-	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
-	return services;
-}
-/** The dev services a run uses, one entry per service it runs. */
-function devServicesUsed(services) {
-	const used = [];
-	if (services.mailpit.length > 0) used.push({
-		service: "mailpit",
-		ids: services.mailpit
-	});
-	if (services.minio.length > 0) used.push({
-		service: "minio",
-		ids: services.minio
-	});
-	return used;
+function setGeneratedSecret(state, appName, secretName, value) {
+	if (!state.generatedSecrets) state.generatedSecrets = {};
+	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
+	state.generatedSecrets[appName][secretName] = value;
 }
-/** The line a run prints for each dev service a deployed stage uses. */
-function devServiceWarning(stage, use) {
-	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
+/**
+* Set DNS verification record for a hostname (mutates state)
+*/
+function setDnsVerification(state, hostname, serverIp) {
+	if (!state.dnsVerified) state.dnsVerified = {};
+	state.dnsVerified[hostname] = {
+		serverIp,
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
 }
 /**
-* Report each dev service a run uses: a loud line, and a `dev-service.used`
-* event a host can act on.
+* Check if a hostname is already verified with the given IP
 */
-function reportDevServices(ctx, uses) {
-	for (const use of uses) {
-		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
-		ctx.emit({
-			type: "dev-service.used",
-			service: use.service,
-			stage: ctx.stage,
-			constructs: use.ids
-		});
-	}
+function isDnsVerified(state, hostname, serverIp) {
+	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
 }
-//#endregion
-//#region src/deploy/actor.ts
 /**
-* Who wrote a stage's deploy state: a GitHub Actions run, or a person at a
-* machine. Recorded on every state write (`updatedBy`), on every resource
-* record and on every release (`releasedBy`), so "who put this here" has an
-* answer that does not depend on anyone's memory.
+* Get the key for a DNS record in state
 */
-/** Whether `env` is a CI job — GitHub Actions or any runner that sets `CI`. */
-function isCi(env = process.env) {
-	return env.GITHUB_ACTIONS === "true" || env.CI === "true";
+function getDnsRecordKey(name, type) {
+	return `${name}:${type}`;
 }
-/** Who this process is writing as. */
-function currentActor(env = process.env) {
-	if (env.GITHUB_ACTIONS === "true") {
-		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
-		return {
-			kind: "github",
-			actor: env.GITHUB_ACTOR ?? "unknown",
-			run: `${server}/${env.GITHUB_REPOSITORY ?? "unknown"}/actions/runs/${env.GITHUB_RUN_ID ?? "unknown"}`,
-			...env.GITHUB_WORKFLOW ? { workflow: env.GITHUB_WORKFLOW } : {}
-		};
-	}
-	let user = "unknown";
-	try {
-		user = userInfo().username;
-	} catch {}
-	return {
-		kind: "local",
-		user,
-		host: hostname()
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-/** `octocat (deploy, https://github.com/…/runs/1)` or `ada@laptop`. */
-function describeActor(actor) {
-	if (!actor) return "unknown";
-	if (actor.kind === "local") return `${actor.user}@${actor.host}`;
-	return `${actor.actor} (${actor.workflow ? `${actor.workflow}, ` : ""}${actor.run})`;
-}
-//#endregion
-//#region src/deploy/dnsResources.ts
-/** The resource type of a DNS record gkm wrote. */
-const DNS_RECORD_RESOURCE = "dns-record";
-/** A record's full name: `api.example.com`, or the domain for `@`. */
-function dnsRecordFqdn(domain, name) {
-	return name === "@" || name === "" ? domain : `${name}.${domain}`;
+/**
+* Get backup state from state
+*/
+function getBackupState(state) {
+	return state?.backups;
 }
-/** `dns-record:<fqdn>:<type>` */
-function dnsResourceKey(fqdn, type) {
-	return `${DNS_RECORD_RESOURCE}:${fqdn.toLowerCase()}:${type.toUpperCase()}`;
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
 }
-/** The resource record a written DNS record is kept as. */
-function dnsRecordResource(record) {
-	const fqdn = dnsRecordFqdn(record.domain, record.name).toLowerCase();
-	const type = record.type.toUpperCase();
-	const data = {
-		domain: record.domain,
-		name: record.name,
-		value: record.value,
-		ttl: record.ttl,
-		...record.provider ? { provider: record.provider } : {}
-	};
-	return {
-		key: dnsResourceKey(fqdn, type),
-		type: DNS_RECORD_RESOURCE,
-		id: `${fqdn} ${type}`,
-		status: "ready",
-		data
-	};
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
 }
-/** Records that gkm wrote `record` — or updates the value it holds. */
-async function recordDnsResource(journal, record) {
-	const { key, type, id, data } = dnsRecordResource(record);
-	await journal.ready({
-		key,
-		type,
-		...data ? { data } : {}
-	}, id);
-}
-/** Forgets a DNS record gkm deleted. */
-async function forgetDnsResource(journal, record) {
-	await journal.forget(dnsResourceKey(dnsRecordFqdn(record.domain, record.name), record.type));
+//#endregion
+//#region src/target/dokploy/dns/index.ts
+/**
+* DNS orchestration for deployments
+*
+* Handles automatic DNS record creation for deployed applications.
+*/
+const logger$1 = output;
+/**
+* Check if DNS config is legacy format (single domain with `domain` property)
+*/
+function isLegacyDnsConfig(config) {
+	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
 }
 /**
-* The changes a DNS step made, kept: what it created, updated or wrote is
-* recorded, what it deleted is forgotten. A record it found already right is
-* recorded only if gkm wrote it before; one it left to a person is not.
+* Normalize DNS config to new multi-domain format
 */
-async function recordDnsChanges(journal, changes, providerOf) {
-	for (const change of changes) {
-		if (change.action === "delete") {
-			await forgetDnsResource(journal, change);
-			continue;
-		}
-		const written = change.action === "create" || change.action === "update" || change.action === "write";
-		const known = change.action === "unchanged" && journal.record(dnsResourceKey(dnsRecordFqdn(change.domain, change.name), change.type)) !== void 0;
-		if (!written && !known || change.value === void 0) continue;
-		const provider = providerOf(change.domain);
-		await recordDnsResource(journal, {
-			domain: change.domain,
-			name: change.name,
-			type: change.type,
-			value: change.value,
-			ttl: change.ttl ?? 0,
-			...provider ? { provider } : {}
-		});
+function normalizeDnsConfig(config) {
+	if (isLegacyDnsConfig(config)) {
+		const { domain, ...providerConfig } = config;
+		return { [domain]: providerConfig };
 	}
+	return config;
 }
-/** Every DNS record gkm wrote for the stage, from its resource records. */
-function dnsResources(resources) {
-	return Object.values(resources).filter((record) => record.type === DNS_RECORD_RESOURCE).map((record) => {
-		const data = record.data ?? {};
-		const [fqdn = "", type = ""] = (record.id ?? "").split(" ");
-		return {
-			...data,
-			type,
-			fqdn
-		};
-	}).sort((a, b) => a.fqdn.localeCompare(b.fqdn) || a.type.localeCompare(b.type));
-}
-//#endregion
-//#region src/deploy/StateProvider.ts
 /**
-* Check if value is a StateProvider implementation.
+* Find the root domain for a hostname from available DNS configs
+*
+* @example
+* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
+* // Returns 'geekmidas.com'
 */
-function isStateProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
+function findRootDomain(hostname, dnsConfig) {
+	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
+	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
+	return null;
 }
-var StateLocked = class extends GkmError {
-	stage;
-	holder;
-	location;
-	constructor(stage, holder, location) {
-		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
-		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
-		this.stage = stage;
-		this.holder = holder;
-		this.location = location;
-		this.name = "StateLocked";
-	}
-};
-var StateVersionConflict = class extends GkmError {
-	stage;
-	expectedVersion;
-	actualVersion;
-	constructor(stage, expectedVersion, actualVersion) {
-		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
-		this.stage = stage;
-		this.expectedVersion = expectedVersion;
-		this.actualVersion = actualVersion;
-		this.name = "StateVersionConflict";
-	}
-};
-var StageStateMissing = class extends GkmError {
-	stage;
-	constructor(stage) {
-		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
-		this.stage = stage;
-		this.name = "StageStateMissing";
-	}
-};
-var StateUnreadable = class extends GkmError {
-	stage;
-	location;
-	constructor(stage, location, cause) {
-		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateUnreadable";
-	}
-};
-var StateSchemaTooNew = class extends GkmError {
-	stage;
-	schemaVersion;
-	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (3). Upgrade @geekmidas/cli to the version that wrote it.`);
-		this.stage = stage;
-		this.schemaVersion = schemaVersion;
-		this.name = "StateSchemaTooNew";
-	}
-};
 /**
-* Not thrown: emitted (once per store) when a custom `StateProvider` stands
-* in for a store, so a deploy that cannot be protected from a concurrent one
-* says so.
+* Group hostnames by their root domain
 */
-var StateStoreWithoutLocking = class extends GkmError {
-	provider;
-	constructor(provider) {
-		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
-		this.provider = provider;
-		this.name = "StateStoreWithoutLocking";
-	}
-};
-var StateStoreNeedsWorkspaceName = class extends GkmError {
-	provider;
-	constructor(provider) {
-		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
-		this.provider = provider;
-		this.name = "StateStoreNeedsWorkspaceName";
-	}
-};
-var UnknownStateProvider = class extends GkmError {
-	config;
-	constructor(config) {
-		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
-		this.config = config;
-		this.name = "UnknownStateProvider";
+function groupHostnamesByDomain(appHostnames, dnsConfig) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [appName, hostname] of appHostnames) {
+		const rootDomain = findRootDomain(hostname, dnsConfig);
+		if (!rootDomain) {
+			logger$1.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			continue;
+		}
+		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
+		grouped.get(rootDomain).set(appName, hostname);
 	}
-};
+	return grouped;
+}
 /**
-* A deploy, setup or rollback of a stage in CI, with the stage's state kept on
-* the runner — which is discarded when the job ends.
+* Resolve IP address from a hostname
 */
-var LocalStateInCi = class extends GkmError {
-	stage;
-	operation;
-	region;
-	constructor(stage, operation, region) {
-		super(`\`gkm ${operation}\` would keep stage '${stage}'s deploy state in .gkm/ on this CI runner, and the runner is discarded when the job ends: the next run would start without it — no releases to roll back to, no record of what was created. Keep the state in AWS — in gkm.config.ts:\n\n  state: { provider: 'ssm', region: '${region}' },\n\nthen move the state you already have, from the machine that holds it:\n\n  gkm state:push --stage ${stage}\n`);
-		this.stage = stage;
-		this.operation = operation;
-		this.region = region;
-		this.name = "LocalStateInCi";
-	}
-};
-/** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends GkmError {
-	stage;
-	location;
-	constructor(stage, location) {
-		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateStoreBusy";
-	}
-};
-function decodeDocument(stage, body, location) {
-	let parsed;
+async function resolveHostnameToIp(hostname) {
 	try {
-		parsed = JSON.parse(body);
+		return (await lookup(hostname, { family: 4 })).address;
 	} catch (error) {
-		throw new StateUnreadable(stage, location, error);
+		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
 	}
-	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
-	const schemaVersion = parsed.schemaVersion;
-	if (schemaVersion === void 0) return {
-		schemaVersion: 1,
-		state: parsed
-	};
-	if (schemaVersion === 2) return {
-		schemaVersion: 2,
-		document: parsed
-	};
-	if (schemaVersion === 3) return {
-		schemaVersion: 3,
-		document: parsed
-	};
-	throw new StateSchemaTooNew(stage, schemaVersion);
-}
-function encodeDocument(document) {
-	return JSON.stringify(document, null, 2);
 }
 /**
-* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
-* so the first journaled deploy after an upgrade adopts them rather than
-* treating them as unknown.
+* Extract subdomain from full hostname relative to root domain
+*
+* @example
+* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
+* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
 */
-function migrateV1(stage, state) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const resources = {};
-	const seed = (type, name, id) => {
-		if (!id) return;
-		const key = name ? `${type}:${name}` : type;
-		resources[key] = {
-			key,
-			type,
-			id,
-			status: "ready",
-			updatedAt: now
-		};
-	};
-	seed("project", null, state.projectId);
-	seed("environment", null, state.environmentId);
-	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
-	seed("postgres", null, state.services?.postgresId);
-	seed("redis", null, state.services?.redisId);
-	seed("backup-destination", null, state.backups?.destinationId);
-	return {
-		schemaVersion: 2,
-		stage,
-		serial: 1,
-		state,
-		resources,
-		updatedAt: now
-	};
+function extractSubdomain(hostname, rootDomain) {
+	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
+	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
 }
-const isEmpty = (value) => !value || Object.keys(value).length === 0;
 /**
-* Whether a v2 state in the Dokploy shape was written by the compose target.
-*
-* Before v3 every target wrote the Dokploy shape, and compose filled none of
-* its Dokploy fields. So the rule is the shape's content, not the target the
-* workspace names now: a state whose every Dokploy-only field is empty — no
-* project or environment id, no application or service ids, no credentials,
-* generated secrets, backups or registry — holds nothing only Dokploy could
-* use, and reading it as compose loses nothing. One with any of them was
-* written by Dokploy and is kept exactly as it is.
-*
-* The configured target is not used: a document decodes the same wherever it
-* is read (`state:show`, `state:push`) without a workspace, a stage can be
-* moved between targets, and `--target` can override a run.
+* Generate required DNS records for a deployment
 */
-function writtenByCompose(state) {
-	return !state.projectId && !state.environmentId && isEmpty(state.applications) && !state.services?.postgresId && !state.services?.redisId && isEmpty(state.appCredentials) && isEmpty(state.generatedSecrets) && !state.backups && !state.registryId;
+function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
+	const records = [];
+	for (const [appName, hostname] of appHostnames) {
+		const subdomain = extractSubdomain(hostname, rootDomain);
+		records.push({
+			hostname,
+			subdomain,
+			type: "A",
+			value: serverIp,
+			appName
+		});
+	}
+	return records;
 }
 /**
-* A v2 state and its records as v3 keeps them. A compose-written state
-* becomes the compose shape: its `dnsRecords` become `dns-record` resources,
-* and `dnsVerified` and the empty Dokploy fields go — the DNS check is made
-* on every deploy. A Dokploy state is returned as it is.
+* Print DNS records table
 */
-function upgradeV2State(state, resources) {
-	if (!writtenByCompose(state)) return {
-		state,
-		resources
-	};
-	const compose = {
-		provider: "compose",
-		stage: state.stage,
-		lastDeployedAt: state.lastDeployedAt,
-		...state.identity ? { identity: state.identity } : {},
-		...state.releases ? { releases: state.releases } : {}
-	};
-	const upgraded = { ...resources };
-	for (const record of Object.values(state.dnsRecords ?? {})) {
-		const resource = migratedDnsResource(record);
-		upgraded[resource.key] = resource;
+function printDnsRecordsTable(records, rootDomain) {
+	logger$1.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$1.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$1.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$1.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	for (const record of records) {
+		const subdomain = record.subdomain.padEnd(35);
+		const type = record.type.padEnd(4);
+		const value = record.value.padEnd(15);
+		let status;
+		if (record.error) status = "✗";
+		else if (record.created) status = "✓ new";
+		else if (record.existed) status = "✓";
+		else status = "?";
+		logger$1.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	return {
-		state: compose,
-		resources: upgraded
-	};
-}
-/** A v2 `dnsRecords` entry as the `dns-record` resource v3 keeps. */
-function migratedDnsResource(record) {
-	return {
-		...dnsRecordResource({
-			domain: record.domain,
-			name: record.name,
-			type: record.type,
-			value: record.value,
-			ttl: record.ttl
-		}),
-		updatedAt: record.createdAt
-	};
-}
-/** A v2 document as v3 — not written until the next write. */
-function migrateV2(document) {
-	const { state, resources } = upgradeV2State(document.state, document.resources);
-	return {
-		schemaVersion: 3,
-		stage: document.stage,
-		serial: document.serial,
-		state,
-		resources,
-		updatedAt: document.updatedAt,
-		history: []
-	};
-}
-function newLockHolder(options) {
-	let owner = "unknown";
-	try {
-		owner = userInfo().username;
-	} catch {}
-	return {
-		id: randomUUID(),
-		owner,
-		host: hostname(),
-		pid: process.pid,
-		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
-		operation: options?.operation
-	};
-}
-function contentVersion(body) {
-	return createHash("sha256").update(body).digest("hex").slice(0, 16);
+	logger$1.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
-* `history` with this write at its head. A run makes many writes — one per
-* resource it journals — so a run is one entry: a write by the run that
-* wrote the newest entry (the same lock) replaces it, and any other is
-* added. Without a lock, each write is its own entry.
+* Print DNS records in a simple format for manual setup
 */
-function appendHistory(history, entry, sameRun) {
-	return [entry, ...sameRun ? history.slice(1) : history].slice(0, 20);
+function printDnsRecordsSimple(records, rootDomain) {
+	logger$1.log("\n   📋 Required DNS Records:");
+	logger$1.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$1.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$1.log("");
 }
 /**
-* A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration,
-* resource records and history are the same for every such backend, so they
-* live here.
+* Create DNS records for a single domain using its configured provider
 */
-var DocumentStateStore = class {
-	/** The lock this store holds for each stage — what its writes are for. */
-	held = /* @__PURE__ */ new Map();
-	/** Per stage, the lock whose run wrote the newest history entry. */
-	logged = /* @__PURE__ */ new Map();
-	/** Who this store writes as. */
-	actor() {
-		return currentActor();
-	}
-	async lock(stage, options) {
-		const holder = newLockHolder(options);
-		await this.createLock(stage, holder);
-		this.held.set(stage, holder);
-		let released = false;
-		return {
-			stage,
-			holder,
-			release: async () => {
-				if (released) return;
-				released = true;
-				if (this.held.get(stage)?.id === holder.id) this.held.delete(stage);
-				await this.removeLock(stage, holder);
-			}
-		};
-	}
-	async forceUnlock(stage) {
-		const holder = await this.readLock(stage);
-		await this.removeLock(stage, null);
-		return holder;
-	}
-	async read(stage) {
-		const current = await this.readDocument(stage);
-		if (!current) return null;
-		return {
-			state: current.document.state,
-			resources: current.document.resources,
-			history: current.document.history,
-			version: current.version
-		};
-	}
-	async write(stage, state, options) {
-		if (options.expectedVersion === null) {
-			const document = this.stamp(stage, {
-				schemaVersion: 3,
-				stage,
-				serial: 1,
-				state,
-				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				history: []
-			});
-			return this.writeRaw(stage, encodeDocument(document), null);
-		}
-		return this.mutate(stage, options.expectedVersion, (document) => ({
-			...document,
-			state
-		}));
-	}
-	async putResource(stage, record, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => ({
-			...document,
-			resources: {
-				...document.resources,
-				[record.key]: {
-					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-					updatedBy: this.actor()
-				}
-			}
-		}));
-	}
-	async deleteResource(stage, key, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => {
-			const { [key]: _removed, ...resources } = document.resources;
-			return {
-				...document,
-				resources
-			};
-		});
-	}
-	/** `document` as this write leaves it: who wrote it, in its history. */
-	stamp(stage, document) {
-		const by = this.actor();
-		const holder = this.held.get(stage);
-		const operation = holder?.operation ?? "write";
-		const history = document.history ?? [];
-		const sameRun = holder !== void 0 && this.logged.get(stage) === holder.id && history[0]?.operation === operation;
-		if (holder) this.logged.set(stage, holder.id);
-		return {
-			...document,
-			updatedBy: by,
-			history: appendHistory(history, {
-				serial: document.serial,
-				at: document.updatedAt,
-				by,
-				operation
-			}, sameRun)
-		};
-	}
-	async mutate(stage, expectedVersion, change) {
-		const current = await this.readDocument(stage);
-		if (!current) {
-			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
-			throw new StageStateMissing(stage);
-		}
-		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
-		const next = change(current.document);
-		next.schemaVersion = 3;
-		next.serial = current.document.serial + 1;
-		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(this.stamp(stage, next)), current.version);
-	}
-	/**
-	* Reads the stage's document as v3. A v1 document is migrated in place on
-	* the way — itself a conditional write: if another run migrated (or wrote)
-	* first, its result is read instead. A v2 document is upgraded in memory
-	* and written as v3 by the next write.
-	*/
-	async readDocument(stage, attempt = 0) {
-		const raw = await this.readRaw(stage);
-		if (!raw) return null;
-		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 3) return {
-			document: decoded.document,
-			version: raw.version
-		};
-		if (decoded.schemaVersion === 2) return {
-			document: migrateV2(decoded.document),
-			version: raw.version
-		};
-		await this.writeV1Backup(stage, raw.body);
-		const document = this.stamp(stage, migrateV2(migrateV1(stage, decoded.state)));
-		try {
-			return {
-				document,
-				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
-			};
-		} catch (error) {
-			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
-			throw error;
-		}
-	}
-};
-/** Whether `config` keeps state on this machine — `local`, or none given. */
-function isLocalState(config) {
-	return !config || config.provider === "local";
-}
-/**
-* Refuses, with `LocalStateInCi`, a run that would write a deployed stage's
-* state to a CI runner's disk — the local stage, which runs on the runner
-* itself, is exempt. Local use is untouched. The region the message
-* suggests is the secrets store's, when the workspace keeps them in AWS.
-*/
-function assertStateOutlivesRun(workspace, stage, operation, env = process.env) {
-	if (stage === workspace.stages?.local) return;
-	if (!isCi(env) || !isLocalState(workspace.state)) return;
-	const store = workspace.secrets?.store;
-	throw new LocalStateInCi(stage, operation, typeof store === "object" && store && typeof store.region === "string" ? store.region : "<region>");
-}
-function isStateStore(value) {
-	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
-}
-/**
-* The store for a workspace's `state` config:
-*
-* - none / `'local'`: `LocalStateStore` under `.gkm/`
-* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
-*   a stale local copy can never win over it
-* - `'s3'`: `S3StateStore`
-* - a `StateStore` object: used as is
-* - a `StateProvider` object: wrapped by `LegacyStateStore`
-*/
-async function createStateStore(options) {
-	const { config, workspaceRoot, workspaceName } = options;
-	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-D40_SDmJ.mjs").then((n) => n.n);
-		return new LocalStateStore(workspaceRoot);
-	}
-	if (isStateStore(config.provider)) return config.provider;
-	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-CtwO7fwy.mjs");
-		return new LegacyStateStore(config.provider, { warn: options.warn });
-	}
-	if (config.provider === "ssm") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-k_Ew7TWx.mjs");
-		const ssm = config;
-		return SSMStateStore.create({
-			workspaceName,
-			region: ssm.region,
-			profile: ssm.profile
-		});
-	}
-	if (config.provider === "s3") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-BzS0IeSt.mjs");
-		const s3 = config;
-		return S3StateStore.create({
-			workspaceName,
-			bucket: s3.bucket,
-			prefix: s3.prefix,
-			region: s3.region,
-			profile: s3.profile
-		});
-	}
-	throw new UnknownStateProvider(config);
-}
-//#endregion
-//#region src/target/dokploy/dns/DnsProvider.ts
-/**
-* Check if value is a DnsProvider implementation.
-*/
-function isDnsProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
-}
-/**
-* Create a DNS provider based on configuration.
-*
-* - 'hostinger': HostingerProvider
-* - 'route53': Route53Provider
-* - 'godaddy': GoDaddyProvider
-* - 'manual': Returns null (user handles DNS)
-* - Custom: Use provided DnsProvider implementation
-*/
-async function createDnsProvider(options) {
-	const { config } = options;
-	if (config.provider === "manual") return null;
-	if (isDnsProvider(config.provider)) return config.provider;
-	const provider = config.provider;
-	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-1mqD6aG8.mjs");
-		return new HostingerProvider();
-	}
-	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-QXxjkZO1.mjs");
-		const route53Config = config;
-		return new Route53Provider({
-			region: route53Config.region,
-			profile: route53Config.profile,
-			hostedZoneId: route53Config.hostedZoneId
-		});
-	}
-	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-Mi3vptSR.mjs");
-		return new GoDaddyProvider(options.godaddy ?? {});
-	}
-	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
-	throw new DnsProviderUnknown(config);
-}
-/**
-* The provider's credentials can write records and not read them — a key
-* scoped to updates only. What reads them falls back to writing every record,
-* which is idempotent, without a diff.
-*/
-var DnsRecordsUnreadable = class extends GkmError {
-	provider;
-	domain;
-	reason;
-	constructor(provider, domain, reason) {
-		super(`The ${provider} key cannot read ${domain}'s DNS records (${reason}), so changes cannot be compared with what is there: every record is written, which leaves one that already has its value as it was.`);
-		this.provider = provider;
-		this.domain = domain;
-		this.reason = reason;
-		this.name = "DnsRecordsUnreadable";
-	}
-};
-/** A DNS provider gkm names and does not have yet. */
-var DnsProviderNotImplemented = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The ${provider} DNS provider is not implemented yet. Use 'route53', 'godaddy', 'hostinger' or 'manual' for this domain in dns, or pass your own DnsProvider object.`);
-		this.provider = provider;
-		this.name = "DnsProviderNotImplemented";
-	}
-};
-/** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
-var DnsProviderUnknown = class extends GkmError {
-	config;
-	constructor(config) {
-		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
-		this.config = config;
-		this.name = "DnsProviderUnknown";
-	}
-};
-//#endregion
-//#region src/deploy/state.ts
-/**
-* Create a new empty state for a stage
-*/
-function createEmptyState(stage, projectId, environmentId) {
-	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/** A new compose stage's state. */
-function createComposeState(stage) {
-	return {
-		provider: "compose",
-		stage,
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* `state` as the Dokploy target keeps it. A stage whose state another target
-* wrote — one moved from compose to Dokploy — keeps its core (releases,
-* identity) and starts with no Dokploy ids, as a first deploy would.
-*/
-function asDokployState(state) {
-	if (state.provider === "dokploy") return state;
-	const { provider: _provider, ...core } = state;
-	return {
-		...core,
-		provider: "dokploy",
-		projectId: "",
-		environmentId: "",
-		applications: {},
-		services: {}
-	};
-}
-/**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/** Two records naming the same image: by digest when both have one. */
-function sameImage(a, b) {
-	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
-}
-/** The newest release in `history` after `index` that a rollback may restore. */
-function restorable(history, index, current) {
-	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
-}
-/**
-* Record that `image` went live for `appName` (mutates state): it becomes
-* `current`, and what was current becomes `previous`. Releasing what already
-* runs — a redeploy of the same digest — changes nothing.
-*/
-function recordRelease(state, appName, image, by, releasedAt = /* @__PURE__ */ new Date()) {
-	const releases = state.releases?.[appName];
-	if (releases && sameImage(releases.current, image)) return;
-	const entry = {
-		...image,
-		releasedAt: releasedAt.toISOString(),
-		releasedBy: by
-	};
-	const history = [entry, ...releases?.history ?? []].slice(0, 10);
-	const previous = releases?.current;
-	state.releases = {
-		...state.releases,
-		[appName]: {
-			current: entry,
-			...previous ? { previous } : {},
-			history
-		}
-	};
-}
-/**
-* Record that `appName` was rolled back to `to` (mutates state): every
-* release newer than it is marked rolled back, so neither this rollback nor
-* a later one restores it, and `previous` moves to the release before `to`.
-*/
-function recordRollback(state, appName, to) {
-	const releases = state.releases?.[appName];
-	if (!releases) return;
-	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
-	if (index === -1) return;
-	const history = releases.history.map((entry, i) => i < index ? {
-		...entry,
-		rolledBack: true
-	} : entry);
-	const current = history[index];
-	const previous = restorable(history, index, current);
-	state.releases = {
-		...state.releases,
-		[appName]: {
-			current,
-			...previous ? { previous } : {},
-			history
-		}
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
-*/
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
-}
-/**
-* Set a created DNS record in state (mutates state)
-*/
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Get backup state from state
-*/
-function getBackupState(state) {
-	return state?.backups;
-}
-/**
-* Set backup state (mutates state)
-*/
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
-}
-//#endregion
-//#region src/target/dokploy/dns/index.ts
-/**
-* DNS orchestration for deployments
-*
-* Handles automatic DNS record creation for deployed applications.
-*/
-const logger$1 = output;
-/**
-* Check if DNS config is legacy format (single domain with `domain` property)
-*/
-function isLegacyDnsConfig(config) {
-	return typeof config === "object" && config !== null && "provider" in config && "domain" in config;
-}
-/**
-* Normalize DNS config to new multi-domain format
-*/
-function normalizeDnsConfig(config) {
-	if (isLegacyDnsConfig(config)) {
-		const { domain, ...providerConfig } = config;
-		return { [domain]: providerConfig };
-	}
-	return config;
-}
-/**
-* Find the root domain for a hostname from available DNS configs
-*
-* @example
-* findRootDomain('api.geekmidas.com', { 'geekmidas.com': {...}, 'geekmidas.dev': {...} })
-* // Returns 'geekmidas.com'
-*/
-function findRootDomain(hostname, dnsConfig) {
-	const domains = Object.keys(dnsConfig).sort((a, b) => b.length - a.length);
-	for (const domain of domains) if (hostname === domain || hostname.endsWith(`.${domain}`)) return domain;
-	return null;
-}
-/**
-* Group hostnames by their root domain
-*/
-function groupHostnamesByDomain(appHostnames, dnsConfig) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const [appName, hostname] of appHostnames) {
-		const rootDomain = findRootDomain(hostname, dnsConfig);
-		if (!rootDomain) {
-			logger$1.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
-			continue;
-		}
-		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
-		grouped.get(rootDomain).set(appName, hostname);
-	}
-	return grouped;
-}
-/**
-* Resolve IP address from a hostname
-*/
-async function resolveHostnameToIp(hostname) {
-	try {
-		return (await lookup(hostname, { family: 4 })).address;
-	} catch (error) {
-		throw new Error(`Failed to resolve IP for ${hostname}: ${error instanceof Error ? error.message : "Unknown error"}`);
-	}
-}
-/**
-* Extract subdomain from full hostname relative to root domain
-*
-* @example
-* extractSubdomain('api.joemoer.traflabs.io', 'traflabs.io') => 'api.joemoer'
-* extractSubdomain('joemoer.traflabs.io', 'traflabs.io') => 'joemoer'
-*/
-function extractSubdomain(hostname, rootDomain) {
-	if (!hostname.endsWith(rootDomain)) throw new Error(`Hostname ${hostname} is not under root domain ${rootDomain}`);
-	return hostname.slice(0, -(rootDomain.length + 1)) || "@";
-}
-/**
-* Generate required DNS records for a deployment
-*/
-function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
-	const records = [];
-	for (const [appName, hostname] of appHostnames) {
-		const subdomain = extractSubdomain(hostname, rootDomain);
-		records.push({
-			hostname,
-			subdomain,
-			type: "A",
-			value: serverIp,
-			appName
-		});
-	}
-	return records;
-}
-/**
-* Print DNS records table
-*/
-function printDnsRecordsTable(records, rootDomain) {
-	logger$1.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$1.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$1.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$1.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
-	for (const record of records) {
-		const subdomain = record.subdomain.padEnd(35);
-		const type = record.type.padEnd(4);
-		const value = record.value.padEnd(15);
-		let status;
-		if (record.error) status = "✗";
-		else if (record.created) status = "✓ new";
-		else if (record.existed) status = "✓";
-		else status = "?";
-		logger$1.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
-	}
-	logger$1.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
-}
-/**
-* Print DNS records in a simple format for manual setup
-*/
-function printDnsRecordsSimple(records, rootDomain) {
-	logger$1.log("\n   📋 Required DNS Records:");
-	logger$1.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$1.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$1.log("");
-}
-/**
-* Create DNS records for a single domain using its configured provider
-*/
-async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
-	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
-	let provider;
-	try {
-		provider = await createDnsProvider({ config: providerConfig });
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$1.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
-		return records.map((r) => ({
-			...r,
-			error: message
+async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
+	const ttl = "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300;
+	let provider;
+	try {
+		provider = await createDnsProvider({ config: providerConfig });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Unknown error";
+		logger$1.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		return records.map((r) => ({
+			...r,
+			error: message
 		}));
 	}
 	if (!provider) return records.map((r) => ({
@@ -8146,2172 +7235,943 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
-//#region src/compose/dns.ts
-/**
-* A compose stage's DNS: the records its public hosts need, and the check that
-* they resolve to its server before a certificate is asked for.
-*
-* - **The server** (`serverAddress`): the stage's own secrets hold its public
-*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
-*   Reserved for gkm: never handed to an app.
-* - **The plan** (`planStackDns`, pure): every public host the stack serves —
-*   its apex, each app, each file server, the public log UI — pointed at the
-*   server. An A record per host (and an AAAA with an IPv6 address), or, where
-*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
-*   record for the target and a CNAME to it for every other host but the
-*   apex, which DNS forbids a CNAME at.
-* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
-*   a record set at a time. A record with the right value is left alone; one
-*   with another value is replaced and the change printed. A `manual` domain
-*   is printed and nothing else. A dry run reads, prints and writes nothing.
-* - **The check** (`checkStackDns`): each host resolved with the system
-*   resolver. One that is not the server stops the deploy with
-*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
-*   for a certificate it cannot get — and use up the rate limit trying.
-*/
-/** The line that says how to set the server's address. */
-function serverAddressHint(stage) {
-	return `gkm secrets:set ${SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
-}
-/** A server address in the stage's secrets that is not an address. */
-var ServerAddressInvalid = class extends GkmError {
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
 	stage;
-	key;
-	value;
-	constructor(stage, key, value) {
-		const ipv4 = key === SERVER_IPV4_KEY;
-		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
 		this.stage = stage;
-		this.key = key;
-		this.value = value;
-		this.name = "ServerAddressInvalid";
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
 	}
-};
-/**
-* A compose stage that serves real domains with no server address: its hosts
-* cannot be pointed or checked, and a certificate would be asked for blind.
-*/
-var ServerAddressMissing = class extends GkmError {
-	stage;
-	domain;
-	constructor(stage, domain) {
-		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${SERVER_IPV6_KEY} for an IPv6 address).`);
-		this.stage = stage;
-		this.domain = domain;
-		this.name = "ServerAddressMissing";
+	static async open(store, stage, initial, adopt = (stored) => stored) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
 	}
-};
-/**
-* The server's address from the stage's secrets, checked — `undefined` when
-* `GKM_SERVER_IPV4` is not set.
-*
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function serverAddress(stage, custom) {
-	const ipv4 = custom?.[SERVER_IPV4_KEY]?.trim();
-	const ipv6 = custom?.[SERVER_IPV6_KEY]?.trim();
-	if (ipv6 && !isIPv6(ipv6)) throw new ServerAddressInvalid(stage, SERVER_IPV6_KEY, ipv6);
-	if (!ipv4) return void 0;
-	if (!isIPv4(ipv4)) throw new ServerAddressInvalid(stage, SERVER_IPV4_KEY, ipv4);
-	return {
-		ipv4,
-		...ipv6 ? { ipv6 } : {}
-	};
-}
-/**
-* A name that resolves to this machine by definition — `localhost` and every
-* `*.localhost` — and is in nobody's DNS.
-*/
-function isLocalHost(host) {
-	const name = host.toLowerCase().replace(/\.$/, "");
-	return name === "localhost" || name.endsWith(".localhost");
-}
-/**
-* The server's address, required where the stage serves real domains — not
-* `*.localhost` ones, which point at this machine already.
-*
-* @throws {ServerAddressMissing} when the stage has a domain and no address
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function requiredServerAddress(stage, domain, custom) {
-	const server = serverAddress(stage, custom);
-	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
-	return server;
-}
-const MANAGED = [
-	"A",
-	"AAAA",
-	"CNAME"
-];
-/** Every public host the stack serves, once each, sorted. */
-function stackHosts(stack) {
-	return [...new Set(stack.routes.map((route) => route.host))].sort();
-}
-/** The TTL a domain's records are written with. */
-function recordTtl(config) {
-	const ttl = "ttl" in config ? config.ttl : void 0;
-	if (ttl) return ttl;
-	return config.provider === "godaddy" ? 600 : 300;
-}
-function providerName(config) {
-	return typeof config.provider === "string" ? config.provider : "custom";
-}
-/** The records a stage's hosts need — pure. */
-function planStackDns(input) {
-	const { stage, server } = input;
-	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
-	const records = /* @__PURE__ */ new Map();
-	const uncovered = [];
-	const add = (host, domain, type, value) => {
-		const name = extractSubdomain(host, domain);
-		records.set(`${domain} ${name} ${type}`, {
-			host,
-			domain,
-			name,
-			type,
-			value,
-			ttl: recordTtl(dns[domain])
-		});
-	};
-	const pointAt = (host, domain) => {
-		add(host, domain, "A", server.ipv4);
-		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
-	};
-	for (const raw of input.hosts) {
-		const host = raw.toLowerCase();
-		const domain = findRootDomain(host, dns);
-		if (!domain) {
-			uncovered.push(host);
-			continue;
-		}
-		const target = cnameTarget(dns[domain].records, stage);
-		if (target) pointAt(target, domain);
-		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
-		else pointAt(host, domain);
-	}
-	const domains = /* @__PURE__ */ new Map();
-	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
-		const config = dns[record.domain];
-		const plan = domains.get(record.domain) ?? {
-			domain: record.domain,
-			provider: providerName(config),
-			config,
-			records: []
-		};
-		plan.records.push(record);
-		domains.set(record.domain, plan);
+	record(key) {
+		return this.resources[key];
 	}
-	return {
-		stage,
-		server,
-		domains: [...domains.values()],
-		uncovered: uncovered.sort()
-	};
-}
-/** `api.example.com  A  203.0.113.10  (TTL 600)` */
-function describe(record) {
-	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
-}
-function printManual(plan, log, why) {
-	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
-	for (const record of plan.records) log(`     ${describe(record)}`);
-	return plan.records.map((r) => ({
-		domain: r.domain,
-		name: r.name,
-		type: r.type,
-		action: "manual",
-		value: r.value,
-		ttl: r.ttl
-	}));
-}
-/** The existing records of every planned name, for the types gkm manages. */
-async function existingRecords(provider, plan) {
-	const names = [...new Set(plan.records.map((r) => r.name))];
-	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
-		name,
-		type
-	})));
-	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
-	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
-}
-const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
-/**
-* What each domain's records need, compared with what is there: creates,
-* updates, and the deletes a change of mode needs — a name moving from an A
-* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
-*/
-function diffDomainDns(plan, existing) {
-	const changes = [];
-	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
-	const planned = /* @__PURE__ */ new Map();
-	for (const record of plan.records) {
-		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
-		types.add(record.type);
-		planned.set(record.name, types);
-	}
-	for (const [name, types] of planned) {
-		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
-		for (const type of conflicting) {
-			const found = find(name, type);
-			if (!found || found.values.length === 0) continue;
-			changes.push({
-				domain: plan.domain,
-				name,
-				type,
-				action: "delete",
-				previous: found.values.join(", ")
-			});
-		}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
 	}
-	for (const record of plan.records) {
-		const found = find(record.name, record.type);
-		const base = {
-			domain: plan.domain,
-			name: record.name,
-			type: record.type,
-			value: record.value,
-			ttl: record.ttl
-		};
-		if (!found || found.values.length === 0) changes.push({
-			...base,
-			action: "create"
-		});
-		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
-			...base,
-			action: "unchanged"
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
 		});
-		else changes.push({
-			...base,
-			action: "update",
-			previous: found.values.join(", ")
+	}
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
 		});
 	}
-	return changes;
-}
-/** A host's full name from a domain and a relative name. */
-function fullName(domain, name) {
-	return name === "@" ? domain : `${name}.${domain}`;
-}
-function printChange(change, dryRun, log) {
-	const host = fullName(change.domain, change.name).padEnd(32);
-	const type = change.type.padEnd(5);
-	const would = dryRun ? "would " : "";
-	switch (change.action) {
-		case "unchanged":
-			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
-			break;
-		case "create":
-			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
-			break;
-		case "update":
-			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
-			break;
-		case "write":
-			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
-			break;
-		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
-	}
-}
-/**
-* Each domain's records, through its provider. Returns every change, the
-* unchanged included; a dry run makes none of them.
-*/
-async function applyStackDns(plan, options = {}) {
-	const dryRun = options.dryRun === true;
-	const log = options.log ?? ((line) => console.log(line));
-	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
-		config,
-		...options.credentials ? { godaddy: options.credentials } : {}
-	}));
-	const changes = [];
-	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
-	for (const domain of plan.domains) {
-		if (domain.provider === "manual") {
-			changes.push(...printManual(domain, log, "manual"));
-			continue;
-		}
-		const provider = await providerFor(domain.config);
-		if (!provider) {
-			changes.push(...printManual(domain, log, "manual"));
-			continue;
-		}
-		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
-		let existing;
-		let diff;
-		try {
-			existing = await existingRecords(provider, domain);
-			diff = diffDomainDns(domain, existing);
-		} catch (error) {
-			if (!(error instanceof DnsRecordsUnreadable)) throw error;
-			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
-			existing = [];
-			diff = domain.records.map((r) => ({
-				domain: r.domain,
-				name: r.name,
-				type: r.type,
-				action: "write",
-				value: r.value,
-				ttl: r.ttl
-			}));
-		}
-		for (const change of diff) printChange(change, dryRun, log);
-		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
-			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
-			const planned = domain.records.find((r) => r.name === name && r.type === "A");
-			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
 		}
-		changes.push(...diff);
-		if (dryRun) continue;
-		const deletes = diff.filter((c) => c.action === "delete");
-		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
-			name: c.name,
-			type: c.type
-		})));
-		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
-		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
-			name: c.name,
-			type: c.type,
-			value: c.value,
-			ttl: c.ttl
-		})));
-	}
-	return changes;
-}
-/** The system resolver: what the server's own clients would be told. */
-const systemLookup = async (host) => {
-	return (await lookup(host, { all: true })).map((a) => a.address);
-};
-/** Hosts that do not resolve to the stage's server. */
-var HostNotPointingAtServer = class extends GkmError {
-	stage;
-	hosts;
-	expected;
-	fix;
-	constructor(stage, hosts, expected, fix) {
-		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
-		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
-		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
-		this.stage = stage;
-		this.hosts = hosts;
-		this.expected = expected;
-		this.fix = fix;
-		this.name = "HostNotPointingAtServer";
-	}
-};
-/**
-* Every host resolved: each must resolve to the server's IPv4 address and to
-* nothing but the server's addresses.
-*
-* @throws {HostNotPointingAtServer} naming every host that does not
-*/
-async function checkStackDns(input) {
-	const lookup = input.lookup ?? systemLookup;
-	const { server } = input;
-	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
-	const bad = [];
-	const ok = [];
-	for (const host of input.hosts) {
-		let resolved;
-		try {
-			resolved = [...new Set(await lookup(host))];
-		} catch (error) {
-			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
-			bad.push({
-				host,
-				resolved: [],
-				error: code
-			});
-			continue;
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
 		}
-		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
-		else bad.push({
-			host,
-			resolved
-		});
-	}
-	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
-		ipv4: server.ipv4,
-		...server.ipv6 ? { ipv6: server.ipv6 } : {}
-	}, dnsFix(input, bad));
-	return ok;
-}
-/** How to fix it: `gkm setup`, or the records to create by hand. */
-function dnsFix(input, bad) {
-	const hosts = bad.map((h) => h.host);
-	let plan;
-	try {
-		plan = planStackDns({
-			stage: input.stage,
-			hosts,
-			server: input.server,
-			dns: input.dns
-		});
-	} catch {
-		plan = {
-			stage: input.stage,
-			server: input.server,
-			domains: [],
-			uncovered: hosts
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
 		};
 	}
-	const automatic = plan.domains.filter((d) => d.provider !== "manual");
-	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
-	const lines = [];
-	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
-	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
-	return lines.join("\n");
-}
-//#endregion
-//#region src/docker/imageRef.ts
-/**
-* An image reference, checked before it reaches `docker`.
-*
-* The parts come from the workspace — a registry in `gkm.config.ts`, an image
-* name from the project, a tag from `--tag` — and an argument array already
-* keeps them out of a shell. What it cannot do is stop `docker` reading a value
-* that starts with `-` as one of its own flags, so a ref is held to Docker's
-* own grammar (distribution/reference) and anything else is refused by name
-* before a build starts.
-*/
-const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
-const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
-const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
-const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
-/** Docker refuses a repository name longer than this. */
-const MAX_NAME_LENGTH = 255;
-/** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends GkmError {
-	ref;
-	constructor(ref) {
-		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
-		this.ref = ref;
-		this.name = "ImageRefInvalid";
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
 	}
-};
-/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
-function validateImageRef(ref) {
-	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
-	return ref;
-}
-//#endregion
-//#region src/docker/index.ts
-const logger = output;
-/** `docker build` failed; what docker printed above says why. */
-var DockerBuildFailed = class extends Error {
-	imageRef;
-	constructor(imageRef, cause) {
-		super(`Failed to build Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-		this.imageRef = imageRef;
-		this.name = "DockerBuildFailed";
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
 	}
-};
-/** `docker push` failed — usually the registry login or its permissions. */
-var DockerPushFailed = class extends Error {
-	imageRef;
-	constructor(imageRef, cause) {
-		super(`Failed to push Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-		this.imageRef = imageRef;
-		this.name = "DockerPushFailed";
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
 	}
 };
-/** `gkm docker --push` was asked for with nowhere to push to. */
-var PushNeedsRegistry = class extends GkmError {
-	imageName;
-	constructor(imageName) {
-		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
-		this.imageName = imageName;
-		this.name = "PushNeedsRegistry";
+//#endregion
+//#region src/providers/types.ts
+/** The manifest kinds a stage can name a provider for. */
+const PROVIDER_KINDS = ["objects"];
+//#endregion
+//#region src/providers/notes.ts
+/** The constructs of a kind: `objects` is every bucket. */
+function constructsOf(manifest, kind) {
+	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
+}
+/** A stage that names `false` for a kind, and declares constructs of it. */
+var StageProviderDisabled = class extends GkmError {
+	kind;
+	stage;
+	ids;
+	constructor(kind, stage, ids) {
+		super(`deploy.${kind}.${stage} is false — the stage has no ${kind} — and ${ids.join(", ")} ${ids.length === 1 ? "is" : "are"} declared. Name what backs ${ids.length === 1 ? "it" : "them"} on '${stage}' (deploy.${kind}.${stage}: 'external', or a provider), or remove the ${ids.length === 1 ? "construct" : "constructs"}.`);
+		this.kind = kind;
+		this.stage = stage;
+		this.ids = ids;
+		this.name = "StageProviderDisabled";
 	}
 };
+/** The command a stage's providers are run with: every deploy runs them. */
+function provisionCommand(stage) {
+	return `gkm deploy --stage ${stage}`;
+}
 /**
-* Docker command implementation: one Dockerfile per deployable app, each
-* building its image inside Docker from a turbo-pruned slice of the build
-* root — nothing is built on the host — plus the build root's
-* `.dockerignore` and `docker-compose.constructs.yml`.
+* The line a stage missing a key a provider would write is given: what
+* creates it, and with which credentials. Undefined when no provider backs
+* the kind on the stage.
 */
-async function dockerCommand(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const loaded = await loadWorkspaceConfig(cwd);
-	const names = loaded.type === "single" ? Object.fromEntries(Object.keys(loaded.workspace.apps).map((name) => [name, resolveDockerConfig(loaded.raw).imageName])) : {};
-	const result = await workspaceDockerCommand(loaded.workspace, loaded.manifest, names, loaded.background, options.stage);
-	if (options.build) for (const app of result.apps) await buildDockerImage(app, result.buildRoot, options);
-	if (options.push) for (const app of result.apps) await pushDockerImage(app.imageName, options, result.buildRoot);
-	return result;
+function provisionHint(workspace, kind, stage) {
+	const choice = stageProvider(workspace, kind, stage);
+	if (choice.mode !== "provider") return void 0;
+	const provisioning = provisioningOf(kind, choice.name);
+	if (!provisioning) return void 0;
+	return `deploy.${kind}.${stage} is ${choice.name}: the deploy (${provisionCommand(stage)}) creates it and writes this key, with ${provisioning.describe}` + (provisioning.login ? `, or gkm login --provider ${provisioning.login}` : "");
 }
 /**
-* Build one app's image, from the build root.
-* Uses BuildKit for cache mount support
+* What a deploy's checks read off the stage's providers: whether each kind is
+* accounted for — a provider, or `false` — so no dev service stands in for
+* it, and what creates a missing key of it.
 */
-async function buildDockerImage(app, buildRoot, options) {
-	const tag = options.tag ?? "latest";
-	const registry = options.registry;
-	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
-	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
-	try {
-		await run$1("docker", [
-			"build",
-			`--file=${relative(buildRoot, app.dockerfile)}`,
-			`--tag=${fullImageName}`,
-			"."
-		], {
-			cwd: buildRoot,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			}
-		});
-		logger.log(`✅ Docker image built: ${fullImageName}`);
-	} catch (error) {
-		throw new DockerBuildFailed(fullImageName, error);
-	}
+function stageProviderNotes(workspace, stage) {
+	if (stageProvider(workspace, "objects", stage).mode === "external") return {};
+	const hint = provisionHint(workspace, "objects", stage);
+	return { objects: {
+		accounted: true,
+		...hint ? { hint } : {}
+	} };
 }
 /**
-* Push Docker image to registry
+* A kind the stage set to `false`, declared anyway — refused before anything
+* else is checked. Pure: what a stack is composed from.
+*
+* @throws {StageProviderDisabled}
 */
-async function pushDockerImage(imageName, options, cwd) {
-	const tag = options.tag ?? "latest";
-	const registry = options.registry;
-	if (!registry) throw new PushNeedsRegistry(imageName);
-	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
-	try {
-		await run$1("docker", ["push", fullImageName], { cwd });
-		logger.log(`✅ Docker image pushed: ${fullImageName}`);
-	} catch (error) {
-		throw new DockerPushFailed(fullImageName, error);
+function assertStageProvidersEnabled(workspace, manifest, stage) {
+	for (const kind of PROVIDER_KINDS) {
+		const ids = constructsOf(manifest, kind);
+		if (ids.length === 0) continue;
+		if (stageProvider(workspace, kind, stage).mode === "none") throw new StageProviderDisabled(kind, stage, ids);
 	}
 }
+//#endregion
+//#region src/deploy/devServices.ts
 /**
-* Generate Dockerfiles for all apps in a workspace.
-* @internal Exported for testing
+* Mail and object storage on a deployed stage: real ones, or — only when
+* someone asked — the dev services the local stage runs.
+*
+* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
+* nobody has to configure either. Deployed, the same two containers would be
+* a stage that silently delivers no mail and keeps its files on one
+* container's disk. So a deployed stage on a server target takes both from
+* its secrets — the mail server's URL and sending address, and each bucket's
+* URL — and a stage missing any of them fails before anything is built,
+* provisioned or written, naming every key at once.
+*
+* A bucket's credentials are not checked: they are optional, and come from
+* either of two places. The bucket's URL may carry a key of its own
+* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
+* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
+* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
+*
+* `--allow-dev-services` is the way out for a stage that is not production —
+* a preview, a demo: every construct the stage does not account for gets the
+* dev service the local stage runs for it — a bucket MinIO, mail Mailpit —
+* and the target derives the keys from it. What the stage does account for
+* still wins: a key set in its secrets, or a provider (`deploy.objects`)
+* that backs the kind. Every run that uses one says so, loudly.
+*
+* Pure: what each target runs is decided here from declarations and the
+* stage's values, and the targets do the running.
 */
-async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}, stage) {
-	const results = [];
-	const layout = imageLayout(workspace);
-	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	logger.log(`   Build root: ${layout.buildRoot}`);
-	logger.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
-	for (const [appName, app] of Object.entries(workspace.apps)) {
-		if (app.type === "mobile") {
-			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
-			continue;
-		}
-		const buildType = app.entry ? "entry" : app.type;
-		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
-		const dockerfile = appDockerfile(appName, app, {
-			layout,
-			workspaceRoot: workspace.root,
-			apps: workspace.apps,
-			...manifest ? { manifest } : {},
-			workspace,
-			...stage ? { stage } : {}
-		});
-		const path = dockerfileOf(appName, app.path);
-		const dockerfilePath = join(workspace.root, path);
-		await mkdir(dirname(dockerfilePath), { recursive: true });
-		await writeFile(dockerfilePath, dockerfile);
-		logger.log(`      Generated: ${path}`);
-		results.push({
-			appName,
-			type: app.type,
-			dockerfile: dockerfilePath,
-			imageName: imageNames[appName] ?? appName
-		});
-	}
-	for (const worker of manifest ? workerUnits(workspace, manifest, background) : []) {
-		logger.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
-		const dockerfile = workerDockerfile(worker, workspace.apps[worker.app], {
-			layout,
-			workspaceRoot: workspace.root
-		});
-		const path = workerDockerfileOf(worker.name);
-		const dockerfilePath = join(workspace.root, path);
-		await mkdir(dirname(dockerfilePath), { recursive: true });
-		await writeFile(dockerfilePath, dockerfile);
-		logger.log(`      Generated: ${path}`);
-		results.push({
-			appName: worker.name,
-			type: "backend",
-			dockerfile: dockerfilePath,
-			imageName: imageNames[worker.name] ?? worker.name
-		});
+/**
+* The dev services a deployed stage can run — one per kind that has one on
+* every server target: a bucket's MinIO and mail's Mailpit. A cache or a
+* database is not here because a server stage runs its own anyway.
+*/
+const DEV_SERVICES = ["minio", "mailpit"];
+/**
+* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
+* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
+* this pair when the stage set it, or with whatever else the SDK's default
+* chain finds — a role.
+*/
+const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+/** Dev services asked of a target that runs no containers. */
+var DevServicesNeedServerTarget = class extends GkmError {
+	target;
+	constructor(target) {
+		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services.`);
+		this.target = target;
+		this.name = "DevServicesNeedServerTarget";
 	}
-	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
-	logger.log(`\n   Ensured: ${dockerignorePath}`);
-	const composePath = await writeConstructsCompose(workspace);
-	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
-	for (const result of results) {
-		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
+};
+/**
+* `--allow-dev-services` given a value — the list it used to take. It is a
+* switch now: every construct the stage does not account for gets its dev
+* service.
+*/
+var AllowDevServicesTakesNoValue = class extends GkmError {
+	value;
+	constructor(value) {
+		super(`--allow-dev-services takes no value (it was given '${value}'). It runs the dev service for every bucket and mail the stage does not account for — no key in its secrets, no provider in deploy.<kind>.<stage> — so there is nothing to list. Pass --allow-dev-services on its own.`);
+		this.value = value;
+		this.name = "AllowDevServicesTakesNoValue";
 	}
-	printRunInstructions(workspace);
-	return {
-		apps: results,
-		dockerCompose: composePath,
-		dockerignore: dockerignorePath,
-		buildRoot: layout.buildRoot
-	};
-}
+};
 /**
-* One app's Dockerfile, by what it is: a gkm backend bundled by `gkm build`,
-* a backend with its own entry bundled by esbuild, or a site by its
-* framework. The one choice every builder of images makes.
+* Refuses `--allow-dev-services <value>` and `--allow-dev-services=<value>` on
+* a command line, with the reason, before the parser calls the value an
+* excess argument. `gkm deploy` and `gkm compose` take no positional
+* argument, so whatever follows the flag and is not a flag was meant for it.
+*
+* @throws {AllowDevServicesTakesNoValue}
 */
-function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps, app.type === "web" && options.manifest && options.workspace ? siteClientTelemetry(options.manifest, appName, options.workspace, options.stage) : void 0);
-	if (app.type === "web") return siteDockerfile(appName, app, {
-		image,
-		...options.manifest ? { manifest: options.manifest } : {},
-		...options.publicUrlArgs ? { publicUrlArgs: options.publicUrlArgs } : {}
-	});
-	if (app.entry) return generateEntryDockerfile({
-		...image,
-		entry: app.entry,
-		healthCheckPath: "/health"
-	});
-	return generateBackendDockerfile({
-		...image,
-		healthCheckPath: "/health",
-		...options.cache ? { cache: options.cache } : {}
-	});
-}
-/** Where `gkm docker` writes a worker's Dockerfile. */
-function workerDockerfileOf(worker) {
-	return `.gkm/docker/Dockerfile.${worker}`;
+function assertDevServicesFlag(argv) {
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		if (arg.startsWith("--allow-dev-services=")) throw new AllowDevServicesTakesNoValue(arg.slice(arg.indexOf("=") + 1));
+		const next = argv[i + 1];
+		if (arg === "--allow-dev-services" && next && !next.startsWith("-")) throw new AllowDevServicesTakesNoValue(next);
+	}
 }
 /**
-* A Worker's Dockerfile: its host app's build, and the worker's bundle as the
-* runner — see `generateWorkerDockerfile`.
+* A deployed stage with mail or object storage that its secrets do not
+* configure — every missing key, across every app, at once.
 */
-function workerDockerfile(worker, host, options) {
-	return generateWorkerDockerfile({
-		...appImageOptions(options.layout, worker.app, host, options.workspaceRoot),
-		imageName: worker.name,
-		port: WORKER_PORT,
-		worker: worker.id,
-		bundle: workerBundleName(worker.id),
-		healthCheckPath: "/health",
-		...options.cache ? { cache: options.cache } : {}
-	});
-}
+var ExternalServicesNotConfigured = class extends GkmError {
+	stage;
+	missing;
+	constructor(stage, missing) {
+		const standIns = missing.some((m) => m.service !== void 0);
+		const lines = missing.map((m) => {
+			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
+			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "") + (m.hint ? `\n      ${m.hint}` : "");
+		});
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\n` + (standIns ? "For a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.\n\n" : "") + `Or run: gkm secrets:add --stage ${stage}`);
+		this.stage = stage;
+		this.missing = missing;
+		this.name = "ExternalServicesNotConfigured";
+	}
+};
+/** The kinds a deployed stage takes from its secrets, or a dev service. */
+const SERVICE_KINDS = {
+	email: "email",
+	objects: "objects",
+	"file-server": "file-server"
+};
 /**
-* A site's Dockerfile, with an `ARG` for every key its bundler inlines.
+* Every mail and storage construct a manifest declares, each with the apps
+* and workers that read it — a process's environment, a site's build args. A
+* file server's reader reads its bucket too.
 *
-* The keys come from the site's declaration where there is one — every
-* public key its edges give it, `VITE_UPLOADS_SERVER_URL` included — and an
-* `ARG` the Dockerfile does not declare is a build argument the build drops,
-* leaving the bundle with an empty URL.
+* The one list a deploy's readiness check refuses a stage by, every server
+* target decides its dev services from, and `gkm secrets:add` offers — so
+* none of them can disagree.
 */
-function siteDockerfile(appName, app, options) {
-	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && appKey(id) === appName)?.[1] : void 0;
-	const publicUrlArgs = options.publicUrlArgs ?? (declared?.kind === "site" && options.manifest ? Object.keys(publicEnvFor(declared, options.manifest)) : getPublicUrlArgNames(app));
-	const webOpts = {
-		...options.image,
-		publicUrlArgs
+function stageServiceDeclarations(input) {
+	const { manifest } = input;
+	const runnables = input.runnables ?? {};
+	const owners = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!SERVICE_KINDS[declaration.kind]) continue;
+		owners.set(provideKey(id, "url"), id);
+		if (declaration.kind === "email") owners.set(provideKey(id, "from"), id);
+	}
+	const readers = /* @__PURE__ */ new Map();
+	const read = (process, keys) => {
+		for (const key of keys) {
+			const id = owners.get(key);
+			if (!id) continue;
+			const declaration = manifest[id];
+			const of = declaration?.kind === "file-server" ? declaration.of : void 0;
+			for (const owner of of ? [id, of] : [id]) {
+				const set = readers.get(owner) ?? /* @__PURE__ */ new Set();
+				set.add(process);
+				readers.set(owner, set);
+			}
+		}
 	};
-	switch (app.framework) {
-		case "vite": return generateViteStaticDockerfile(webOpts);
-		case "tanstack-start":
-		case "remix": return generateNodeWebDockerfile(webOpts);
-		default: return generateNextjsDockerfile(webOpts);
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const name = appKey(id);
+		if (declaration.kind === "rest-api" || declaration.kind === "site" || declaration.kind === "mobile-app") read(name, appEnvKeys(manifest, name, runnables) ?? []);
+		if (declaration.kind === "site") read(name, Object.values(publicEnvFor(declaration, manifest)));
+		if (declaration.kind === "worker") read(name, workerEnvKeys(manifest, id, runnables) ?? []);
 	}
+	return Object.entries(manifest).flatMap(([id, declaration]) => {
+		const kind = SERVICE_KINDS[declaration.kind];
+		if (!kind) return [];
+		const apps = [...readers.get(id) ?? []].sort();
+		return [{
+			id,
+			kind,
+			...declaration.kind === "file-server" && declaration.of ? { of: declaration.of } : {},
+			...apps.length ? { apps } : {}
+		}];
+	});
 }
 /**
-* What a build root's `.dockerignore` must leave out of every image's
-* context: dependencies installed for another platform, anything built on the
-* host (every image builds from source), git, and gkm's own output —
-* `.gkm/compose`'s env files hold a stage's secrets.
+* Every key a stage must be given rather than derive — the one list both a
+* deploy's checks and `gkm secrets:add` read, so what a deploy refuses and
+* what the builder offers cannot drift.
+*
+* - Deployed, mail is its URL and its sending address, a bucket its URL, and
+*   a file server its public URL. Locally all of it is Mailpit and MinIO.
+* - On every stage, a third party's credentials: nobody but the third party
+*   can issue them.
+*
+* Never a derived value: a database URL, a generated secret, the seed.
 */
-const REQUIRED_IGNORES = [
-	"**/node_modules",
-	".git",
-	"**/dist",
-	"**/.next",
-	"**/.turbo",
-	"**/.gkm",
-	"**/.gkm/compose"
-];
+function requiredStageKeys(input) {
+	const domain = input.domain ?? "example.com";
+	const keys = [];
+	const add = (entry) => {
+		if (!keys.some((k) => k.key === entry.key)) keys.push(entry);
+	};
+	const byId = (list) => [...list ?? []].sort((a, b) => a.id.localeCompare(b.id));
+	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
+	if (!input.local) {
+		const services = byId(input.services);
+		const objects = input.providers?.objects;
+		const storage = objects?.accounted ? objects.hint ? { hint: objects.hint } : {} : { service: "minio" };
+		for (const d of services.filter((d) => d.kind === "email")) {
+			add({
+				key: provideKey(d.id, "url"),
+				id: d.id,
+				kind: "email",
+				what: `where '${d.id}' sends mail — any SMTP server`,
+				example: `smtp://user:password@smtp.${domain}:587`,
+				service: "mailpit",
+				...apps(d)
+			});
+			add({
+				key: provideKey(d.id, "from"),
+				id: d.id,
+				kind: "email",
+				what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+				example: `noreply@${domain}`,
+				service: "mailpit",
+				...apps(d)
+			});
+		}
+		for (const d of services.filter((d) => d.kind === "objects")) add({
+			key: provideKey(d.id, "url"),
+			id: d.id,
+			kind: "bucket",
+			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
+			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
+			example: `s3://${appKey(d.id)}?region=eu-west-1`,
+			...storage,
+			...apps(d)
+		});
+		for (const d of services.filter((d) => d.kind === "file-server")) add({
+			key: provideKey(d.id, "url"),
+			id: d.id,
+			kind: "file-server",
+			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
+			example: `https://${appKey(d.id)}.${domain}`,
+			...storage,
+			...d.of ? { of: d.of } : {},
+			...apps(d)
+		});
+	}
+	if (!input.local && input.server) add({
+		key: SERVER_IPV4_KEY,
+		id: "server",
+		kind: "server",
+		what: "the public IPv4 address of the server the stage's stack runs on — its hosts' DNS records point at it, and every deploy checks they do",
+		note: `${SERVER_IPV6_KEY} adds its IPv6 address (AAAA records); neither is ever handed to an app`,
+		example: "203.0.113.10"
+	});
+	for (const d of byId(input.credentials)) add({
+		key: provideKey(d.id, "credentials"),
+		id: d.id,
+		kind: d.kind,
+		what: d.kind === "external-api" ? `the credentials '${d.id}' was issued for this stage, as its schema describes them` : `the credential '${d.id}', as its schema describes it`,
+		example: "{\"apiKey\":\"…\"}",
+		...apps(d)
+	});
+	return keys;
+}
 /**
-* Make sure the build root's `.dockerignore` leaves out what no image may
-* hold: written whole where there is none, and each missing line appended to
-* one the project keeps.
+* Whether only the stage's secrets can supply `key` to a construct of `kind`
+* — what nothing on the stage derives.
+*
+* A third party's credentials, always. Deployed, also each generated secret
+* and keyring: the stage generated each one once, and every run reads the
+* same value back.
 */
-async function ensureDockerignore(buildRoot) {
-	const path = join(buildRoot, ".dockerignore");
-	if (!existsSync(path)) {
-		await writeFile(path, generateDockerignore());
-		return path;
-	}
-	const current = await readFile(path, "utf-8");
-	const lines = new Set(current.split(/\r?\n/).map((line) => line.trim()));
-	const missing = REQUIRED_IGNORES.filter((line) => !lines.has(line));
-	if (missing.length === 0) return path;
-	await appendFile(path, `${current.endsWith("\n") || current === "" ? "" : "\n"}\n# gkm: images build from source, and a stack's env files hold its secrets\n${missing.join("\n")}\n`);
-	return path;
+function suppliedOnly(kind, id, key, local) {
+	if (kind === "credential") return true;
+	if (kind === "external-api") return key === provideKey(id, "credentials");
+	if (local) return false;
+	return kind === "secret" || kind === "encryption";
 }
 /**
-* Write `docker-compose.constructs.yml` — the same file `gkm dev` writes, with
-* the apps beside the containers their constructs derive.
+* Where a deployed stage's mail and storage come from, and what it lacks.
 *
-* Through reconcile rather than a second generator, so what `gkm docker`
-* describes and what `gkm dev` runs cannot disagree. Nothing is started.
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*
+* The keys themselves are {@link requiredStageKeys}'s.
 */
-async function writeConstructsCompose(workspace) {
-	await reconcileWorkspace(workspace, {
-		stage: workspace.stages.local,
-		start: false
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const required = requiredStageKeys({
+		local: false,
+		services: input.declarations,
+		...input.domain ? { domain: input.domain } : {},
+		...input.providers ? { providers: input.providers } : {}
 	});
-	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
-	return join(workspace.root, COMPOSE_PATH);
-}
-function printRunInstructions(workspace) {
-	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger.log("   gkm setup   # starts the containers and creates what they hold");
-	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
-}
-//#endregion
-//#region src/providers/types.ts
-/** The manifest kinds a stage can name a provider for. */
-const PROVIDER_KINDS = ["objects"];
-//#endregion
-//#region src/providers/notes.ts
-/** The constructs of a kind: `objects` is every bucket. */
-function constructsOf$1(manifest, kind) {
-	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
-}
-/** A stage that names `false` for a kind, and declares constructs of it. */
-var StageProviderDisabled = class extends GkmError {
-	kind;
-	stage;
-	ids;
-	constructor(kind, stage, ids) {
-		super(`deploy.${kind}.${stage} is false — the stage has no ${kind} — and ${ids.join(", ")} ${ids.length === 1 ? "is" : "are"} declared. Name what backs ${ids.length === 1 ? "it" : "them"} on '${stage}' (deploy.${kind}.${stage}: 'external', or a provider), or remove the ${ids.length === 1 ? "construct" : "constructs"}.`);
-		this.kind = kind;
-		this.stage = stage;
-		this.ids = ids;
-		this.name = "StageProviderDisabled";
-	}
-};
-/** The command a stage's providers are run with. */
-function provisionCommand(stage) {
-	return `gkm setup --stage ${stage}`;
+	const standIn = (k) => allow && k.service !== void 0 && !has(k.key);
+	const mailpit = required.filter((k) => k.kind === "email" && k.key === provideKey(k.id, "url")).filter(standIn).map((k) => k.id);
+	const minio = required.filter((k) => k.kind === "bucket").filter(standIn).map((k) => k.id);
+	const covered = (k) => k.kind === "email" && mailpit.includes(k.id) || k.kind === "bucket" && minio.includes(k.id) || k.kind === "file-server" && k.of !== void 0 && minio.includes(k.of);
+	return {
+		missing: required.filter((k) => !has(k.key) && !covered(k)).map(({ key, id, what, note, example, service, apps, hint }) => ({
+			key,
+			id,
+			what,
+			...note ? { note } : {},
+			example,
+			...service ? { service } : {},
+			...apps ? { apps } : {},
+			...hint ? { hint } : {}
+		})),
+		minio,
+		mailpit
+	};
 }
-/**
-* The line a stage missing a key a provider would write is given: what
-* creates it, and with which credentials. Undefined when no provider backs
-* the kind on the stage.
-*/
-function provisionHint(workspace, kind, stage) {
-	const choice = stageProvider(workspace, kind, stage);
-	if (choice.mode !== "provider") return void 0;
-	const provisioning = provisioningOf(kind, choice.name);
-	if (!provisioning) return void 0;
-	return `deploy.${kind}.${stage} is ${choice.name}: ${provisionCommand(stage)} creates it and writes this key, with ${provisioning.describe}` + (provisioning.login ? `, or gkm login --provider ${provisioning.login}` : "");
+/** The dev services a run uses, one entry per service it runs. */
+function devServicesUsed(services) {
+	const used = [];
+	if (services.mailpit.length > 0) used.push({
+		service: "mailpit",
+		ids: services.mailpit
+	});
+	if (services.minio.length > 0) used.push({
+		service: "minio",
+		ids: services.minio
+	});
+	return used;
 }
-/**
-* What a deploy's checks read off the stage's providers: whether each kind is
-* accounted for — a provider, or `false` — so no dev service stands in for
-* it, and what creates a missing key of it.
-*/
-function stageProviderNotes(workspace, stage) {
-	if (stageProvider(workspace, "objects", stage).mode === "external") return {};
-	const hint = provisionHint(workspace, "objects", stage);
-	return { objects: {
-		accounted: true,
-		...hint ? { hint } : {}
-	} };
+/** The line a run prints for each dev service a deployed stage uses. */
+function devServiceWarning(stage, use) {
+	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
 }
 /**
-* A kind the stage set to `false`, declared anyway — refused before anything
-* else is checked. Pure: what a stack is composed from.
-*
-* @throws {StageProviderDisabled}
+* Report each dev service a run uses: a loud line, and a `dev-service.used`
+* event a host can act on.
 */
-function assertStageProvidersEnabled(workspace, manifest, stage) {
-	for (const kind of PROVIDER_KINDS) {
-		const ids = constructsOf$1(manifest, kind);
-		if (ids.length === 0) continue;
-		if (stageProvider(workspace, kind, stage).mode === "none") throw new StageProviderDisabled(kind, stage, ids);
+function reportDevServices(ctx, uses) {
+	for (const use of uses) {
+		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
+		ctx.emit({
+			type: "dev-service.used",
+			service: use.service,
+			stage: ctx.stage,
+			constructs: use.ids
+		});
 	}
 }
 //#endregion
-//#region src/deploy/journal.ts
-var DeployJournal = class DeployJournal {
-	store;
-	stage;
-	state;
-	resources;
-	version;
-	existed;
-	constructor(store, stage, state, resources, version, existed) {
-		this.store = store;
-		this.stage = stage;
-		this.state = state;
-		this.resources = resources;
-		this.version = version;
-		this.existed = existed;
-	}
-	static async open(store, stage, initial, adopt = (stored) => stored) {
-		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
-		const state = initial();
-		const version = await store.write(stage, state, { expectedVersion: null });
-		return new DeployJournal(store, stage, state, {}, version, false);
-	}
-	record(key) {
-		return this.resources[key];
-	}
-	/** The keys a previous run marked `pending` and never saw created. */
-	unfinished() {
-		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
-	}
-	/** Records that `entry` is about to be created. */
-	async pending(entry) {
-		await this.put({
-			...entry,
-			status: "pending"
-		});
-	}
-	/**
-	* Records `entry` as existing with `id`; a no-op if it already is, with
-	* the same data.
-	*/
-	async ready(entry, id) {
-		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
-		await this.put({
-			...entry,
-			status: "ready",
-			id
-		});
-	}
-	/**
-	* The resource `entry` names: by its recorded id, else by looking it up,
-	* else created — with `pending` written before the create and `ready`
-	* after, so a run that dies in between leaves a record the next run
-	* resolves by looking the resource up rather than creating another.
-	*/
-	async ensure(entry, steps) {
-		const record = this.resources[entry.key];
-		let staleId;
-		if (record?.status === "ready" && record.id && steps.get) {
-			const known = await steps.get(record.id);
-			if (known) {
-				await this.ready(entry, steps.id(known));
-				return {
-					resource: known,
-					via: "recorded"
-				};
-			}
-			staleId = record.id;
-		}
-		const existing = await steps.find();
-		if (existing) {
-			await this.ready(entry, steps.id(existing));
-			return {
-				resource: existing,
-				via: record?.status === "pending" ? "resumed" : "found",
-				...staleId ? { staleId } : {}
-			};
-		}
-		await this.pending(entry);
-		const created = await steps.create();
-		await this.ready(entry, steps.id(created));
+//#region src/deploy/actor.ts
+/**
+* Who wrote a stage's deploy state: a GitHub Actions run, or a person at a
+* machine. Recorded on every state write (`updatedBy`), on every resource
+* record and on every release (`releasedBy`), so "who put this here" has an
+* answer that does not depend on anyone's memory.
+*/
+/** Whether `env` is a CI job — GitHub Actions or any runner that sets `CI`. */
+function isCi(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" || env.CI === "true";
+}
+/** Who this process is writing as. */
+function currentActor(env = process.env) {
+	if (env.GITHUB_ACTIONS === "true") {
+		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
 		return {
-			resource: created,
-			via: "created",
-			...staleId ? { staleId } : {}
-		};
-	}
-	/** Removes `key`'s record — a resource that no longer exists. */
-	async forget(key) {
-		if (!(key in this.resources)) return;
-		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
-		const { [key]: _removed, ...resources } = this.resources;
-		this.resources = resources;
-	}
-	/** Every record, as the journal last wrote or read it. */
-	records() {
-		return this.resources;
-	}
-	/** Writes the stage's state, keeping its resource records. */
-	async save() {
-		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
-	}
-	async put(record) {
-		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
-		this.resources = {
-			...this.resources,
-			[record.key]: {
-				...record,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			}
+			kind: "github",
+			actor: env.GITHUB_ACTOR ?? "unknown",
+			run: `${server}/${env.GITHUB_REPOSITORY ?? "unknown"}/actions/runs/${env.GITHUB_RUN_ID ?? "unknown"}`,
+			...env.GITHUB_WORKFLOW ? { workflow: env.GITHUB_WORKFLOW } : {}
 		};
 	}
-};
+	let user = "unknown";
+	try {
+		user = userInfo().username;
+	} catch {}
+	return {
+		kind: "local",
+		user,
+		host: hostname()
+	};
+}
+/** `octocat (deploy, https://github.com/…/runs/1)` or `ada@laptop`. */
+function describeActor(actor) {
+	if (!actor) return "unknown";
+	if (actor.kind === "local") return `${actor.user}@${actor.host}`;
+	return `${actor.actor} (${actor.workflow ? `${actor.workflow}, ` : ""}${actor.run})`;
+}
 //#endregion
-//#region src/providers/dns.ts
-/** Whether the workspace deploys through the compose target. */
-function deploysWithCompose(workspace) {
-	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+//#region src/deploy/dnsResources.ts
+/** The resource type of a DNS record gkm wrote. */
+const DNS_RECORD_RESOURCE = "dns-record";
+/** A record's full name: `api.example.com`, or the domain for `@`. */
+function dnsRecordFqdn(domain, name) {
+	return name === "@" || name === "" ? domain : `${name}.${domain}`;
 }
-/**
-* A compose stage that serves a domain has its server's address in its
-* secrets — checked before `gkm setup --stage` does anything else.
-*
-* @throws {ServerAddressMissing} for a compose stage with a domain and none
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function assertStageServer(workspace, stage, secrets) {
-	if (stage === workspace.stages.local) return void 0;
-	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
-	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+/** `dns-record:<fqdn>:<type>` */
+function dnsResourceKey(fqdn, type) {
+	return `${DNS_RECORD_RESOURCE}:${fqdn.toLowerCase()}:${type.toUpperCase()}`;
 }
-/**
-* The hosts a compose stage serves: its stack composed as a deploy would —
-* with the secrets it would generate made up in memory, never written — and
-* every route's host read off it.
-*/
-async function composeStageHosts(options) {
-	const { workspace, stage } = options;
-	const runnables = options.runnables ?? {};
-	const background = options.background ?? {};
-	const manifest = options.manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root,
-		runnables,
-		background
-	});
-	const stored = await (await secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	})).read(stage);
-	const { deployedStackSecrets } = await import("./secrets-DbPmAS4k.mjs").then((n) => n.n);
-	const { composeStack } = await import("./stack-Co4uZkAo.mjs").then((n) => n.c);
-	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
-	return stackHosts(composeStack({
-		workspace,
-		manifest,
-		runnables,
-		background,
-		stage,
-		identity: deployIdentity(workspace, stage),
-		images: {
-			mode: "pull",
-			tag: "dns",
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
-		},
-		secrets,
-		buildOnly: true,
-		allowDevServices: true
-	}));
+/** The resource record a written DNS record is kept as. */
+function dnsRecordResource(record) {
+	const fqdn = dnsRecordFqdn(record.domain, record.name).toLowerCase();
+	const type = record.type.toUpperCase();
+	const data = {
+		domain: record.domain,
+		name: record.name,
+		value: record.value,
+		ttl: record.ttl,
+		...record.provider ? { provider: record.provider } : {}
+	};
+	return {
+		key: dnsResourceKey(fqdn, type),
+		type: DNS_RECORD_RESOURCE,
+		id: `${fqdn} ${type}`,
+		status: "ready",
+		data
+	};
+}
+/** Records that gkm wrote `record` — or updates the value it holds. */
+async function recordDnsResource(journal, record) {
+	const { key, type, id, data } = dnsRecordResource(record);
+	await journal.ready({
+		key,
+		type,
+		...data ? { data } : {}
+	}, id);
+}
+/** Forgets a DNS record gkm deleted. */
+async function forgetDnsResource(journal, record) {
+	await journal.forget(dnsResourceKey(dnsRecordFqdn(record.domain, record.name), record.type));
 }
 /**
-* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
-* records, created or corrected. A dry run reads and prints, and writes
-* nothing.
+* The changes a DNS step made, kept: what it created, updated or wrote is
+* recorded, what it deleted is forgotten. A record it found already right is
+* recorded only if gkm wrote it before; one it left to a person is not.
 */
-async function provisionStageDns(options) {
-	const { workspace, stage } = options;
-	const log = options.log ?? ((line) => console.log(line));
-	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
-		mode: "none",
-		hosts: [],
-		changes: []
-	};
-	const server = serverAddress(stage, (await (await secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	})).read(stage))?.custom);
-	if (!server) {
-		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
-		return {
-			mode: "none",
-			hosts: [],
-			changes: []
-		};
-	}
-	const hosts = [...options.hosts ?? await composeStageHosts({
-		workspace,
-		stage,
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {},
-		...options.manifest ? { manifest: options.manifest } : {},
-		...options.runnables ? { runnables: options.runnables } : {},
-		...options.background ? { background: options.background } : {}
-	})];
-	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
-	const plan = planStackDns({
-		stage,
-		hosts,
-		server,
-		dns: workspace.dns
-	});
-	try {
-		const changes = await applyStackDns(plan, {
-			...options.dryRun ? { dryRun: true } : {},
-			log,
-			credentials: {
-				env: options.env ?? process.env,
-				...options.home ? { home: options.home } : {},
-				log
-			},
-			...options.providerFor ? { providerFor: options.providerFor } : {}
-		});
-		if (options.journal && !options.dryRun) {
-			const providers = new Map(plan.domains.map((domain) => [domain.domain, domain.provider]));
-			await recordDnsChanges(options.journal, changes, (domain) => providers.get(domain));
-		}
-		return {
-			mode: "records",
-			hosts,
-			changes
-		};
-	} catch (error) {
-		if (error instanceof MissingCredential) {
-			log(`   ⚠ ${error.message}`);
-			log("   Until then, create these records yourself:");
-			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
-			return {
-				mode: "records",
-				hosts,
-				changes: []
-			};
+async function recordDnsChanges(journal, changes, providerOf) {
+	for (const change of changes) {
+		if (change.action === "delete") {
+			await forgetDnsResource(journal, change);
+			continue;
 		}
-		throw error;
+		const written = change.action === "create" || change.action === "update" || change.action === "write";
+		const known = change.action === "unchanged" && journal.record(dnsResourceKey(dnsRecordFqdn(change.domain, change.name), change.type)) !== void 0;
+		if (!written && !known || change.value === void 0) continue;
+		const provider = providerOf(change.domain);
+		await recordDnsResource(journal, {
+			domain: change.domain,
+			name: change.name,
+			type: change.type,
+			value: change.value,
+			ttl: change.ttl ?? 0,
+			...provider ? { provider } : {}
+		});
 	}
 }
-//#endregion
-//#region src/providers/aws.ts
-/**
-* The AWS account a provider provisions in — the stage's, found the way the
-* SSM and Secrets Manager stores find it.
-*
-* 1. `--profile`, resolved on its own: exported keys left over from another
-*    account never win over a profile someone named.
-* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
-*    deploy's own `aws` credential kind (`storedCredentials`).
-* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
-*    whatever `aws-actions/configure-aws-credentials` exported.
-*
-* None of them: the provider has no provisioning credentials, and the stage
-* is treated as `external`.
-*/
-async function awsProvisioningCredentials(lookup) {
-	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
-	const where = region ? { region } : {};
-	if (lookup.profile) return {
-		profile: lookup.profile,
-		...where
-	};
-	const stored = await storedCredentials({
-		env: lookup.env,
-		...lookup.home ? { home: lookup.home } : {}
-	}).get({
-		kind: "aws",
-		stage: lookup.stage
-	});
-	if (stored) return stored;
-	try {
-		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
-		await fromNodeProviderChain({
-			timeout: 1e3,
-			maxRetries: 0
-		})();
+/** Every DNS record gkm wrote for the stage, from its resource records. */
+function dnsResources(resources) {
+	return Object.values(resources).filter((record) => record.type === DNS_RECORD_RESOURCE).map((record) => {
+		const data = record.data ?? {};
+		const [fqdn = "", type = ""] = (record.id ?? "").split(" ");
 		return {
-			chain: true,
-			...where
+			...data,
+			type,
+			fqdn
 		};
-	} catch {
-		return;
-	}
+	}).sort((a, b) => a.fqdn.localeCompare(b.fqdn) || a.type.localeCompare(b.type));
 }
+//#endregion
+//#region src/docker/imageRef.ts
 /**
-* An S3-compatible endpoint the environment points the SDK at — the AWS
-* emulator in tests. The SDK reads it itself; it is read here too, because
-* an emulator takes path-style requests, and a key written for one has to
-* say where it is.
+* An image reference, checked before it reaches `docker`.
+*
+* The parts come from the workspace — a registry in `gkm.config.ts`, an image
+* name from the project, a tag from `--tag` — and an argument array already
+* keeps them out of a shell. What it cannot do is stop `docker` reading a value
+* that starts with `-` as one of its own flags, so a ref is held to Docker's
+* own grammar (distribution/reference) and anything else is refused by name
+* before a build starts.
 */
-function awsEndpoint(env, service) {
-	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
-}
-/** An SDK client's config for a provisioning credential. */
-async function awsClientConfig(credential, region) {
-	if ("profile" in credential) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		return {
-			region,
-			credentials: fromIni({ profile: credential.profile })
-		};
+const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
+const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
+const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
+const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
+/** Docker refuses a repository name longer than this. */
+const MAX_NAME_LENGTH = 255;
+/** A value that is not an image reference was about to be built or pushed. */
+var ImageRefInvalid = class extends GkmError {
+	ref;
+	constructor(ref) {
+		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
+		this.ref = ref;
+		this.name = "ImageRefInvalid";
 	}
-	if ("accessKeyId" in credential) return {
-		region,
-		credentials: {
-			accessKeyId: credential.accessKeyId,
-			secretAccessKey: credential.secretAccessKey,
-			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
-		}
-	};
-	return { region };
+};
+/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
+function validateImageRef(ref) {
+	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
+	return ref;
 }
-const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
-/** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends GkmError {
-	bucket;
-	reason;
-	constructor(bucket, reason) {
-		super(`'${bucket}' is not a valid S3 bucket name: ${reason}. Rename the construct or set deploy.namespace in gkm.config.ts to something that leaves room for it.`);
-		this.bucket = bucket;
-		this.reason = reason;
-		this.name = "InvalidBucketName";
+//#endregion
+//#region src/docker/index.ts
+const logger = output;
+/** `docker build` failed; what docker printed above says why. */
+var DockerBuildFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to build Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerBuildFailed";
 	}
 };
-/** Lowercase `[a-z0-9-]`, runs of anything else one `-`, no edge dashes. */
-function part(value) {
-	return kebabCase(value).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/**
-* `parts` joined by `-`, shortened to `max` characters by trimming the longest
-* part one character at a time — so a long construct id gives way before a
-* short stage name does, and every part keeps its start.
-*/
-function fitParts(parts, max) {
-	const kept = parts.map(part).filter(Boolean);
-	const length = () => kept.reduce((sum, p) => sum + p.length, 0) + kept.length - 1;
-	while (length() > max) {
-		let longest = 0;
-		for (let i = 1; i < kept.length; i++) if (kept[i].length > kept[longest].length) longest = i;
-		if (kept[longest].length <= 1) break;
-		kept[longest] = kept[longest].slice(0, -1).replace(/-+$/, "");
-	}
-	return kept.join("-");
-}
-/** Why `name` is not a valid bucket name, or undefined when it is. */
-function bucketNameProblem(name) {
-	if (name.length < 3 || name.length > 63) return `it is ${name.length} characters, and S3 takes 3 to 63`;
-	if (!/^[a-z0-9-]+$/.test(name)) return "it may hold only lowercase letters, digits and -";
-	if (!/^[a-z0-9].*[a-z0-9]$/.test(name)) return "it must start and end with a letter or a digit";
-	if (name.startsWith("xn--") || name.startsWith("sthree-")) return "it starts with a prefix S3 reserves ('xn--', 'sthree-')";
-	if (name.endsWith("-s3alias") || name.endsWith("--ol-s3")) return "it ends with a suffix S3 reserves ('-s3alias', '--ol-s3')";
-}
-/**
-* The good name: `<namespace>-<project>-<stage>-<bucket id>`, lowercased, no
-* dots, shortened to leave room for a clash's suffix.
-*
-* @throws {InvalidBucketName} when nothing usable is left
-*/
-function bucketName(input) {
-	const name = fitParts([
-		input.scope,
-		input.stage,
-		input.id
-	], 56);
-	const problem = bucketNameProblem(name);
-	if (problem) throw new InvalidBucketName(name, problem);
-	return name;
-}
-/** Six random `[a-z0-9]` characters. */
-function randomSuffix(random = randomInt) {
-	let suffix = "";
-	for (let i = 0; i < 6; i++) suffix += SUFFIX_ALPHABET[random(36)];
-	return suffix;
-}
-/** The good name with a clash's suffix. */
-function suffixedBucketName(good, suffix) {
-	return `${good}-${suffix}`;
-}
-/**
-* The IAM user a bucket is reached with on a stage:
-* `gkm-<project>-<stage>-<bucket id>`, at most 64 characters.
-*/
-function iamUserName(input) {
-	return fitParts([
-		"gkm",
-		input.scope,
-		input.stage,
-		input.id
-	], 64);
-}
-/** The path every user gkm creates is under, so it finds its own. */
-const IAM_USER_PATH = "/gkm/";
-/** The inline policy each user is given. */
-const IAM_POLICY_NAME = "gkm-bucket";
-//#endregion
-//#region src/providers/s3/origins.ts
-/**
-* Which browser origins may call a bucket: the stage's sites that depend on
-* an API using it.
-*
-* The same reading of the graph an API's own CORS origins are — its callers —
-* taken one step further: a site that calls an API which hands it a presigned
-* upload URL is a site whose browser PUTs to the bucket. A site that reads the
-* bucket (or a file server over it) itself is one too. Nothing is written
-* down: add a site that calls the API and the next provision run allows it.
-*/
-/** The keys a reader of this bucket holds: its URL, and each server's over it. */
-function bucketKeys(manifest, bucket) {
-	return [provideKey(bucket, "url"), ...Object.entries(manifest).filter(([, d]) => d.kind === "file-server" && d.of === bucket).map(([id]) => provideKey(id, "url"))];
-}
-function bucketOrigins(input) {
-	const { manifest, workspace, stage } = input;
-	const keys = bucketKeys(manifest, input.bucket);
-	const readers = Object.entries(manifest).filter(([, d]) => d.kind === "rest-api" || d.kind === "site").filter(([id]) => {
-		const env = appEnvKeys(manifest, appKey(id), input.runnables);
-		return env !== void 0 && keys.some((key) => env.has(key));
-	});
-	const sites = /* @__PURE__ */ new Set();
-	for (const [id, declaration] of readers) {
-		if (declaration.kind === "site") {
-			sites.add(id);
-			continue;
-		}
-		for (const caller of dependentsOf(manifest, id)) if (manifest[caller]?.kind === "site") sites.add(caller);
+/** `docker push` failed — usually the registry login or its permissions. */
+var DockerPushFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to push Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerPushFailed";
 	}
-	const origins = /* @__PURE__ */ new Set();
-	const unresolved = [];
-	for (const id of [...sites].sort()) {
-		const name = appKey(id);
-		const app = workspace.apps[name];
-		if (!app) {
-			unresolved.push(name);
-			continue;
-		}
-		try {
-			const host = resolveHost(name, app, stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
-			origins.add(`https://${host}`);
-		} catch (error) {
-			if (!(error instanceof NoDomainForStage)) throw error;
-			unresolved.push(name);
-		}
+};
+/** `gkm docker --push` was asked for with nowhere to push to. */
+var PushNeedsRegistry = class extends GkmError {
+	imageName;
+	constructor(imageName) {
+		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
+		this.imageName = imageName;
+		this.name = "PushNeedsRegistry";
 	}
-	return {
-		origins: [...origins].sort(),
-		unresolved
-	};
-}
-//#endregion
-//#region src/providers/s3/policy.ts
-const bucketArn = (bucket) => `arn:aws:s3:::${bucket}`;
-/**
-* What the app's key may do: objects in this bucket, and listing it — and
-* nothing else in the account.
-*
-* Multipart uploads are in it because a presigned upload of a large file is
-* one, and an abandoned one is cleaned up by the app. Reading old versions is
-* added only when the bucket keeps them.
-*/
-function userPolicy(bucket, options = {}) {
-	return {
-		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmObjects",
-			Effect: "Allow",
-			Action: [
-				"s3:GetObject",
-				"s3:PutObject",
-				"s3:DeleteObject",
-				"s3:AbortMultipartUpload",
-				"s3:ListMultipartUploadParts",
-				...options.versioning ? ["s3:GetObjectVersion"] : []
-			],
-			Resource: `${bucketArn(bucket)}/*`
-		}, {
-			Sid: "GkmBucket",
-			Effect: "Allow",
-			Action: [
-				"s3:ListBucket",
-				"s3:GetBucketLocation",
-				"s3:ListBucketMultipartUploads"
-			],
-			Resource: bucketArn(bucket)
-		}]
-	};
-}
+};
 /**
-* One open pattern as the resource it is public on. A `**` is S3's `*`; a
-* single `*` is too, which crosses `/` where the construct's own check does
-* not — the construct is the stricter of the two (see `bucketPolicy` in
-* reconcile, which the local MinIO is given the same way).
+* Docker command implementation: one Dockerfile per deployable app, each
+* building its image inside Docker from a turbo-pruned slice of the build
+* root — nothing is built on the host — plus the build root's
+* `.dockerignore` and `docker-compose.constructs.yml`.
 */
-function openResource(bucket, pattern) {
-	const path = pattern.replace(/^\/+/, "").replace(/\*\*/g, "*");
-	return `${bucketArn(bucket)}/${path}`;
+async function dockerCommand(options) {
+	const cwd = options.cwd ?? process.cwd();
+	const loaded = await loadWorkspaceConfig(cwd);
+	const names = loaded.type === "single" ? Object.fromEntries(Object.keys(loaded.workspace.apps).map((name) => [name, resolveDockerConfig(loaded.raw).imageName])) : {};
+	const result = await workspaceDockerCommand(loaded.workspace, loaded.manifest, names, loaded.background, options.stage);
+	if (options.build) for (const app of result.apps) await buildDockerImage(app, result.buildRoot, options);
+	if (options.push) for (const app of result.apps) await pushDockerImage(app.imageName, options, result.buildRoot);
+	return result;
 }
 /**
-* The bucket's own policy: every request refused unless it came over TLS,
-* and — only when a file server opens paths on it — anonymous `s3:GetObject`
-* on exactly those prefixes.
+* Build one app's image, from the build root.
+* Uses BuildKit for cache mount support
 */
-function bucketPolicy(bucket, open = []) {
-	const statements = [{
-		Sid: "GkmDenyInsecureTransport",
-		Effect: "Deny",
-		Principal: "*",
-		Action: "s3:*",
-		Resource: [bucketArn(bucket), `${bucketArn(bucket)}/*`],
-		Condition: { Bool: { "aws:SecureTransport": "false" } }
-	}];
-	if (open.length > 0) statements.push({
-		Sid: "GkmOpenPaths",
-		Effect: "Allow",
-		Principal: "*",
-		Action: "s3:GetObject",
-		Resource: [...new Set(open.map((p) => openResource(bucket, p)))].sort()
-	});
-	return {
-		Version: "2012-10-17",
-		Statement: statements
-	};
+async function buildDockerImage(app, buildRoot, options) {
+	const tag = options.tag ?? "latest";
+	const registry = options.registry;
+	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
+	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	try {
+		await run$1("docker", [
+			"build",
+			`--file=${relative(buildRoot, app.dockerfile)}`,
+			`--tag=${fullImageName}`,
+			"."
+		], {
+			cwd: buildRoot,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			}
+		});
+		logger.log(`✅ Docker image built: ${fullImageName}`);
+	} catch (error) {
+		throw new DockerBuildFailed(fullImageName, error);
+	}
 }
 /**
-* Block Public Access. All four flags on, unless the bucket has open paths:
-* then a *policy* may make it public (`BlockPublicPolicy`,
-* `RestrictPublicBuckets` off), and ACLs still may not.
+* Push Docker image to registry
 */
-function publicAccessBlock(open) {
-	return {
-		BlockPublicAcls: true,
-		IgnorePublicAcls: true,
-		BlockPublicPolicy: !open,
-		RestrictPublicBuckets: !open
-	};
-}
-function corsRule(origins) {
-	return {
-		AllowedMethods: [
-			"GET",
-			"HEAD",
-			"POST",
-			"PUT"
-		],
-		AllowedOrigins: [...new Set(origins)].sort(),
-		AllowedHeaders: ["*"],
-		ExposeHeaders: ["ETag"],
-		MaxAgeSeconds: 3e3
-	};
+async function pushDockerImage(imageName, options, cwd) {
+	const tag = options.tag ?? "latest";
+	const registry = options.registry;
+	if (!registry) throw new PushNeedsRegistry(imageName);
+	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
+	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	try {
+		await run$1("docker", ["push", fullImageName], { cwd });
+		logger.log(`✅ Docker image pushed: ${fullImageName}`);
+	} catch (error) {
+		throw new DockerPushFailed(fullImageName, error);
+	}
 }
 /**
-* A policy document in one canonical form — keys sorted, a lone string a
-* one-element list, lists sorted — so one AWS reformatted reads as the same
-* document rather than as drift.
+* Generate Dockerfiles for all apps in a workspace.
+* @internal Exported for testing
 */
-function canonicalPolicy(value) {
-	return JSON.stringify(canonical(value));
-}
-function canonical(value, key) {
-	if (Array.isArray(value)) {
-		const items = value.map((v) => canonical(v));
-		return key === "Statement" ? items : items.map((v) => JSON.stringify(v)).sort();
+async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}, stage) {
+	const results = [];
+	const layout = imageLayout(workspace);
+	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger.log(`   Build root: ${layout.buildRoot}`);
+	logger.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
+	for (const [appName, app] of Object.entries(workspace.apps)) {
+		if (app.type === "mobile") {
+			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			continue;
+		}
+		const buildType = app.entry ? "entry" : app.type;
+		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		const dockerfile = appDockerfile(appName, app, {
+			layout,
+			workspaceRoot: workspace.root,
+			apps: workspace.apps,
+			...manifest ? { manifest } : {},
+			workspace,
+			...stage ? { stage } : {}
+		});
+		const path = dockerfileOf(appName, app.path);
+		const dockerfilePath = join(workspace.root, path);
+		await mkdir(dirname(dockerfilePath), { recursive: true });
+		await writeFile(dockerfilePath, dockerfile);
+		logger.log(`      Generated: ${path}`);
+		results.push({
+			appName,
+			type: app.type,
+			dockerfile: dockerfilePath,
+			imageName: imageNames[appName] ?? appName
+		});
+	}
+	for (const worker of manifest ? workerUnits(workspace, manifest, background) : []) {
+		logger.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
+		const dockerfile = workerDockerfile(worker, workspace.apps[worker.app], {
+			layout,
+			workspaceRoot: workspace.root
+		});
+		const path = workerDockerfileOf(worker.name);
+		const dockerfilePath = join(workspace.root, path);
+		await mkdir(dirname(dockerfilePath), { recursive: true });
+		await writeFile(dockerfilePath, dockerfile);
+		logger.log(`      Generated: ${path}`);
+		results.push({
+			appName: worker.name,
+			type: "backend",
+			dockerfile: dockerfilePath,
+			imageName: imageNames[worker.name] ?? worker.name
+		});
 	}
-	if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((k) => {
-		const v = value[k];
-		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" ? Array.isArray(v) ? v : [v] : v, k)];
-	}));
-	return value;
-}
-//#endregion
-//#region src/providers/s3/index.ts
-/** The tags gkm finds its own buckets and users by. */
-const TAG_PROJECT = "gkm:project";
-const TAG_STAGE = "gkm:stage";
-const TAG_CONSTRUCT = "gkm:construct";
-function bucketConstructs(manifest) {
-	return Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id, d]) => ({
-		id,
-		versioned: d.versioned === true,
-		servers: Object.entries(manifest).filter(([, s]) => s.kind === "file-server" && s.of === id).map(([sid, s]) => ({
-			id: sid,
-			open: s.open ?? []
-		})).sort((a, b) => a.id.localeCompare(b.id))
-	})).sort((a, b) => a.id.localeCompare(b.id));
-}
-/**
-* The region the stage's buckets are created in: the entry's, the secrets
-* store's when it is in AWS, the credential's, `AWS_REGION`.
-*/
-function s3Region(ctx, env = process.env) {
-	const store = ctx.workspace.secrets?.store;
-	const storeRegion = store && typeof store === "object" && "region" in store ? store.region : void 0;
-	const region = ctx.config.region ?? storeRegion ?? ctx.credential?.region ?? env.AWS_REGION ?? env.AWS_DEFAULT_REGION;
-	if (!region) throw new S3RegionRequired(ctx.stage);
-	return region;
-}
-/**
-* The address a file server over `bucket` serves on: the bucket's regional
-* virtual-host endpoint, which is what `FileServer.url(key)` appends a key to
-* — `https://<bucket>.s3.<region>.amazonaws.com/<key>`. Against an emulator,
-* its path-style address.
-*/
-function bucketPublicUrl(bucket, region, endpoint) {
-	if (endpoint) return `${endpoint.replace(/\/+$/, "")}/${bucket}`;
-	return `https://${bucket}.s3.${region}.amazonaws.com`;
-}
-/** What an AWS SDK error is called, whichever field carries it. */
-function errorName(error) {
-	const e = error;
-	return e?.Code ?? e?.name ?? "";
-}
-/** A read whose "there is none" answer is one of `missing`. */
-async function readOr(read, missing) {
-	try {
-		return await read();
-	} catch (error) {
-		if (missing.includes(errorName(error))) return void 0;
-		throw error;
+	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
+	logger.log(`\n   Ensured: ${dockerignorePath}`);
+	const composePath = await writeConstructsCompose(workspace);
+	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
+	for (const result of results) {
+		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
+		logger.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
 	}
-}
-const defaultClients = async (credential, region) => {
-	const S3 = await import("@aws-sdk/client-s3");
-	const IAM = await import("@aws-sdk/client-iam");
-	const config = await awsClientConfig(credential, region);
-	const endpoint = awsEndpoint(process.env, "S3");
+	printRunInstructions(workspace);
 	return {
-		S3,
-		IAM,
-		s3: new S3.S3Client({
-			...config,
-			...endpoint ? {
-				endpoint,
-				forcePathStyle: true
-			} : {}
-		}),
-		iam: new IAM.IAMClient(config),
-		region,
-		...endpoint ? { endpoint } : {}
-	};
-};
-/** For tests: what makes the clients. */
-let makeClients = defaultClients;
-async function ensureS3(ctx) {
-	const region = s3Region(ctx);
-	const clients = await makeClients(ctx.credential, region);
-	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct);
-}
-/** The keys gkm tags a bucket and a user with. */
-function identityTags(ctx, id) {
-	return [
-		{
-			Key: TAG_PROJECT,
-			Value: ctx.identity.key
-		},
-		{
-			Key: TAG_STAGE,
-			Value: ctx.stage
-		},
-		{
-			Key: TAG_CONSTRUCT,
-			Value: id
-		}
-	];
-}
-async function ensureBucket(ctx, clients, construct) {
-	const { id } = construct;
-	const nameInput = {
-		scope: ctx.identity.scope,
-		stage: ctx.stage,
-		id: appKey(id)
+		apps: results,
+		dockerCompose: composePath,
+		dockerignore: dockerignorePath,
+		buildRoot: layout.buildRoot
 	};
-	const versioning = ctx.config.versioning ?? construct.versioned;
-	const open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();
-	const { bucket, exists } = await ensureBucketName(ctx, clients, id, bucketName(nameInput));
-	await ensureBucketSettings(ctx, clients, {
-		id,
-		bucket,
-		exists,
-		versioning,
-		open
-	});
-	await ensureAccessKey(ctx, clients, {
-		id,
-		bucket,
-		...await ensureUser(ctx, clients, id, iamUserName(nameInput), userPolicy(bucket, { versioning }))
-	});
-	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
-	for (const server of construct.servers) {
-		const key = provideKey(server.id, "url");
-		const entry = {
-			key: `file-server:${server.id}`,
-			type: "url"
-		};
-		const recorded = ctx.state.record(entry.key)?.id;
-		const current = ctx.secrets[key];
-		if (current === publicUrl) {
-			await ctx.state.ready(entry, publicUrl);
-			continue;
-		}
-		if (current !== void 0 && current !== recorded) {
-			ctx.log(`   ${key} is set to ${current} by you, and kept — the bucket's own address is ${publicUrl}`);
-			continue;
-		}
-		await ctx.change({
-			construct: server.id,
-			resource: key,
-			change: `set to ${publicUrl}`
-		}, async () => {
-			await ctx.writeSecrets({ [key]: publicUrl });
-			await ctx.state.ready(entry, publicUrl);
-		});
-	}
 }
 /**
-* The bucket's name: the recorded one, else the good name, else the good
-* name with a random suffix — up to {@link SUFFIX_ATTEMPTS} times.
+* One app's Dockerfile, by what it is: a gkm backend bundled by `gkm build`,
+* a backend with its own entry bundled by esbuild, or a site by its
+* framework. The one choice every builder of images makes.
 */
-async function ensureBucketName(ctx, clients, id, good) {
-	const { S3, s3, region } = clients;
-	const key = `s3-bucket:${id}`;
-	const record = ctx.state.record(key);
-	const entry = (name) => ({
-		key,
-		type: "s3-bucket",
-		data: {
-			name,
-			region
-		}
-	});
-	/** Whether this account holds `name`: yes, no, or someone else does. */
-	const probe = async (name) => {
-		try {
-			await s3.send(new S3.HeadBucketCommand({ Bucket: name }));
-			return "ours";
-		} catch (error) {
-			const name = errorName(error);
-			if (name === "NotFound" || name === "NoSuchBucket") return "none";
-			if (name === "Forbidden" || name === "AccessDenied") return "taken";
-			throw error;
-		}
-	};
-	const create = async (name) => {
-		if (ctx.dryRun) {
-			const found = await probe(name);
-			if (found === "none") {
-				await ctx.change({
-					construct: id,
-					resource: `bucket ${name}`,
-					change: `create in ${region}`
-				}, async () => {});
-				return "created";
-			}
-			return found;
-		}
-		await ctx.state.pending(entry(name));
-		try {
-			await s3.send(new S3.CreateBucketCommand({
-				Bucket: name,
-				...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
-			}));
-		} catch (error) {
-			const code = errorName(error);
-			if (code === "BucketAlreadyOwnedByYou") return "ours";
-			if (code === "BucketAlreadyExists") return "taken";
-			throw error;
-		}
-		await ctx.change({
-			construct: id,
-			resource: `bucket ${name}`,
-			change: `create in ${region}`
-		}, async () => {});
-		return "created";
-	};
-	const adopt = async (name) => {
-		const owner = (await readOr(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
-		if (owner && owner !== ctx.identity.key) throw new BucketOwnedByAnotherProject(name, owner, ctx.identity.key);
-	};
-	if (record?.status === "ready" && record.id) {
-		const found = await probe(record.id);
-		if (found === "ours") return {
-			bucket: record.id,
-			exists: true
-		};
-		if (found === "taken") throw new RecordedBucketUnreachable(id, record.id);
-		const made = await create(record.id);
-		if (made === "taken") throw new RecordedBucketUnreachable(id, record.id);
-		if (!ctx.dryRun) await ctx.state.ready(entry(record.id), record.id);
-		return {
-			bucket: record.id,
-			exists: made === "ours"
-		};
-	}
-	const pending = record?.data?.name;
-	const names = [
-		...typeof pending === "string" && pending !== good ? [pending] : [],
-		good,
-		...Array.from({ length: 5 }, () => suffixedBucketName(good, randomSuffix()))
-	];
-	const tried = [];
-	for (const name of names) {
-		tried.push(name);
-		const made = await create(name);
-		if (made === "taken") continue;
-		if (made === "ours") await adopt(name);
-		if (!ctx.dryRun) await ctx.state.ready(entry(name), name);
-		if (name !== good) ctx.log(`   '${good}' is taken by another account; '${id}' is '${name}', recorded in the stage's state`);
-		return {
-			bucket: name,
-			exists: made === "ours"
-		};
-	}
-	throw new BucketNameUnavailable(id, tried.filter((n) => n !== pending));
-}
-/** Tags, Block Public Access, encryption, policy, versioning and CORS. */
-async function ensureBucketSettings(ctx, clients, input) {
-	const { S3, s3 } = clients;
-	const { id, bucket } = input;
-	const Bucket = bucket;
-	const fresh = ctx.dryRun && !input.exists;
-	const read = async (fn, missing) => fresh ? void 0 : readOr(fn, missing);
-	const set = (change, apply) => ctx.change({
-		construct: id,
-		resource: `bucket ${bucket}`,
-		change
-	}, () => apply().then(() => void 0));
-	const tagged = await read(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket })), ["NoSuchTagSet", "NoSuchTagSetError"]);
-	const ours = identityTags(ctx, id);
-	const others = (tagged?.TagSet ?? []).filter((t) => !ours.some((o) => o.Key === t.Key));
-	if (ours.some((o) => !tagged?.TagSet?.some((t) => t.Key === o.Key && t.Value === o.Value))) await set("tag", () => s3.send(new S3.PutBucketTaggingCommand({
-		Bucket,
-		Tagging: { TagSet: [...others, ...ours].map((t) => ({
-			Key: t.Key,
-			Value: t.Value
-		})) }
-	})));
-	const isOpen = input.open.length > 0;
-	const block = publicAccessBlock(isOpen);
-	const ensureBlock = async () => {
-		const now = (await read(() => s3.send(new S3.GetPublicAccessBlockCommand({ Bucket })), ["NoSuchPublicAccessBlockConfiguration"]))?.PublicAccessBlockConfiguration;
-		if (!(now && Object.keys(block).every((k) => (now[k] ?? false) === block[k]))) await set(isOpen ? "block public access (ACLs; the policy opens the open paths)" : "block all public access", () => s3.send(new S3.PutPublicAccessBlockCommand({
-			Bucket,
-			PublicAccessBlockConfiguration: block
-		})));
-	};
-	const policy = bucketPolicy(bucket, input.open);
-	const ensurePolicy = async () => {
-		const current = await read(() => s3.send(new S3.GetBucketPolicyCommand({ Bucket })), ["NoSuchBucketPolicy"]);
-		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
-			Bucket,
-			Policy: JSON.stringify(policy)
-		})));
-	};
-	if (isOpen) {
-		await ensureBlock();
-		await ensurePolicy();
-	} else {
-		await ensurePolicy();
-		await ensureBlock();
-	}
-	if ((await read(() => s3.send(new S3.GetBucketEncryptionCommand({ Bucket })), ["ServerSideEncryptionConfigurationNotFoundError"]))?.ServerSideEncryptionConfiguration?.Rules?.[0]?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm !== "AES256" && !fresh) await set("encrypt by default (SSE-S3)", () => s3.send(new S3.PutBucketEncryptionCommand({
-		Bucket,
-		ServerSideEncryptionConfiguration: { Rules: [{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
-	})));
-	const status = (await read(() => s3.send(new S3.GetBucketVersioningCommand({ Bucket })), []))?.Status;
-	if (input.versioning && status !== "Enabled") await set("enable versioning", () => s3.send(new S3.PutBucketVersioningCommand({
-		Bucket,
-		VersioningConfiguration: { Status: "Enabled" }
-	})));
-	else if (!input.versioning && status === "Enabled") await set("suspend versioning", () => s3.send(new S3.PutBucketVersioningCommand({
-		Bucket,
-		VersioningConfiguration: { Status: "Suspended" }
-	})));
-	const { origins, unresolved } = bucketOrigins({
-		workspace: ctx.workspace,
-		manifest: ctx.manifest,
-		runnables: ctx.runnables,
-		stage: ctx.stage,
-		bucket: id
-	});
-	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
-	if (origins.length === 0) return;
-	const rule = corsRule(origins);
-	const cors = await read(() => s3.send(new S3.GetBucketCorsCommand({ Bucket })), ["NoSuchCORSConfiguration"]);
-	if (!(cors?.CORSRules?.length === 1 && canonicalCors(cors.CORSRules[0]) === canonicalCors(rule))) await set(`CORS for ${origins.join(", ")}`, () => s3.send(new S3.PutBucketCorsCommand({
-		Bucket,
-		CORSConfiguration: { CORSRules: [rule] }
-	})));
-}
-function canonicalCors(rule) {
-	const sorted = (list) => [...list ?? []].sort();
-	return JSON.stringify({
-		AllowedMethods: sorted(rule.AllowedMethods),
-		AllowedOrigins: sorted(rule.AllowedOrigins),
-		AllowedHeaders: sorted(rule.AllowedHeaders),
-		ExposeHeaders: sorted(rule.ExposeHeaders),
-		MaxAgeSeconds: rule.MaxAgeSeconds ?? null
+function appDockerfile(appName, app, options) {
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps, app.type === "web" && options.manifest && options.workspace ? siteClientTelemetry(options.manifest, appName, options.workspace, options.stage) : void 0);
+	if (app.type === "web") return siteDockerfile(appName, app, {
+		image,
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.publicUrlArgs ? { publicUrlArgs: options.publicUrlArgs } : {}
 	});
-}
-/** The bucket's IAM user and its inline policy. */
-async function ensureUser(ctx, clients, id, user, policy) {
-	const { IAM, iam } = clients;
-	const entry = {
-		key: `iam-user:${id}`,
-		type: "iam-user"
-	};
-	const found = await readOr(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
-	if (found?.User) {
-		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
-		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
-		if (found.User.Path !== "/gkm/" || tag("gkm:project") !== ctx.identity.key || tag("gkm:stage") !== ctx.stage) throw new IamUserNotOwned(user, ctx.identity.key, ctx.stage);
-		await ctx.state.ready(entry, user);
-	} else await ctx.change({
-		construct: id,
-		resource: `IAM user ${user}`,
-		change: `create under ${IAM_USER_PATH}`
-	}, async () => {
-		await ctx.state.pending(entry);
-		await iam.send(new IAM.CreateUserCommand({
-			UserName: user,
-			Path: IAM_USER_PATH,
-			Tags: identityTags(ctx, id)
-		}));
-		await ctx.state.ready(entry, user);
+	if (app.entry) return generateEntryDockerfile({
+		...image,
+		entry: app.entry,
+		healthCheckPath: "/health"
 	});
-	const exists = Boolean(found?.User) || !ctx.dryRun;
-	const current = exists ? await readOr(() => iam.send(new IAM.GetUserPolicyCommand({
-		UserName: user,
-		PolicyName: IAM_POLICY_NAME
-	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
-	const document = current?.PolicyDocument ? JSON.parse(decodePolicy(current.PolicyDocument)) : void 0;
-	if (!document || canonicalPolicy(document) !== canonicalPolicy(policy)) await ctx.change({
-		construct: id,
-		resource: `IAM user ${user}`,
-		change: `policy ${IAM_POLICY_NAME}: this bucket only`
-	}, async () => {
-		await iam.send(new IAM.PutUserPolicyCommand({
-			UserName: user,
-			PolicyName: IAM_POLICY_NAME,
-			PolicyDocument: JSON.stringify(policy)
-		}));
+	return generateBackendDockerfile({
+		...image,
+		healthCheckPath: "/health",
+		...options.cache ? { cache: options.cache } : {}
 	});
-	return {
-		user,
-		exists
-	};
 }
-/** IAM returns a policy document URL-encoded; an emulator may not. */
-function decodePolicy(document) {
-	try {
-		return decodeURIComponent(document);
-	} catch {
-		return document;
-	}
+/** Where `gkm docker` writes a worker's Dockerfile. */
+function workerDockerfileOf(worker) {
+	return `.gkm/docker/Dockerfile.${worker}`;
 }
 /**
-* The user's access key, in the stage's secrets as the bucket's URL.
-*
-* - First run: one key, written into the stage's secrets.
-* - `--rotate-keys`: a second key, written in place of the first; the first
-*   stays active until the stage has deployed with the second, and the next
-*   run after that deploy — or `--retire-old-keys` — deletes it.
-* - A key the secrets no longer hold (a store emptied by hand): replaced the
-*   same way, since its secret cannot be read back.
+* A Worker's Dockerfile: its host app's build, and the worker's bundle as the
+* runner — see `generateWorkerDockerfile`.
 */
-async function ensureAccessKey(ctx, clients, input) {
-	const { IAM, iam } = clients;
-	const { id, bucket, user } = input;
-	const urlKey = provideKey(id, "url");
-	const entryKey = `iam-access-key:${id}`;
-	const record = ctx.state.record(entryKey);
-	const given = ctx.secrets[urlKey];
-	let inUrl;
-	if (given !== void 0) {
-		let parsed;
-		try {
-			parsed = s3Url.parse(given);
-		} catch {
-			parsed = void 0;
-		}
-		if (parsed?.bucket !== bucket) throw new BucketKeySetElsewhere(urlKey, bucket, parsed?.bucket ?? given.replace(/\/\/[^@]*@/, "//"), ctx.stage);
-		inUrl = parsed.accessKeyId;
-	}
-	const listed = input.exists ? (await iam.send(new IAM.ListAccessKeysCommand({ UserName: user }))).AccessKeyMetadata?.map((k) => k.AccessKeyId) ?? [] : [];
-	let current = record?.status === "ready" ? record.id : void 0;
-	let previous = typeof record?.data?.previous === "string" ? record.data.previous : void 0;
-	const rotatedAt = typeof record?.data?.rotatedAt === "string" ? record.data.rotatedAt : void 0;
-	const entry = (data = {}) => ({
-		key: entryKey,
-		type: "iam-access-key",
-		data: {
-			user,
-			...data
-		}
-	});
-	if (previous && current) {
-		const deployed = rotatedAt !== void 0 && ctx.state.lastDeployedAt !== void 0 && ctx.state.lastDeployedAt > rotatedAt;
-		if (ctx.retireOldKeys || deployed) {
-			const old = previous;
-			const keep = current;
-			await ctx.change({
-				construct: id,
-				resource: `IAM user ${user}`,
-				change: `delete the rotated-out access key ${old}`
-			}, async () => {
-				if (listed.includes(old)) await iam.send(new IAM.DeleteAccessKeyCommand({
-					UserName: user,
-					AccessKeyId: old
-				}));
-				await ctx.state.ready(entry(), keep);
-			});
-			previous = void 0;
-		} else ctx.log(`   ${id}: the old access key ${previous} stays active until '${ctx.stage}' is deployed with the new one; the next gkm setup --stage ${ctx.stage} after that deletes it (or pass --retire-old-keys)`);
-	}
-	if (!current && inUrl && listed.includes(inUrl)) {
-		await ctx.state.ready(entry(), inUrl);
-		current = inUrl;
-	}
-	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) return;
-	if (ctx.rotateKeys && previous) throw new RotationInProgress(id, previous, ctx.stage);
-	const outgoing = current && listed.includes(current) ? current : void 0;
-	if (listed.length >= 2) throw new AccessKeyLimit(user, listed);
-	const why = !current ? "create an access key" : ctx.rotateKeys ? "rotate: issue a new access key" : "issue a new access key (the secrets no longer hold the recorded one)";
-	await ctx.change({
-		construct: id,
-		resource: `IAM user ${user}`,
-		change: why
-	}, async () => {
-		await ctx.state.pending(entry(outgoing ? { previous: outgoing } : {}));
-		const key = (await iam.send(new IAM.CreateAccessKeyCommand({ UserName: user }))).AccessKey;
-		await ctx.writeSecrets({ [urlKey]: s3Url.build({
-			bucket,
-			region: clients.region,
-			...clients.endpoint ? {
-				endpoint: clients.endpoint,
-				forcePathStyle: true
-			} : {},
-			accessKeyId: key.AccessKeyId,
-			secretAccessKey: key.SecretAccessKey
-		}) });
-		await ctx.state.ready(entry(outgoing ? {
-			previous: outgoing,
-			rotatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : {}), key.AccessKeyId);
+function workerDockerfile(worker, host, options) {
+	return generateWorkerDockerfile({
+		...appImageOptions(options.layout, worker.app, host, options.workspaceRoot),
+		imageName: worker.name,
+		port: WORKER_PORT,
+		worker: worker.id,
+		bundle: workerBundleName(worker.id),
+		healthCheckPath: "/health",
+		...options.cache ? { cache: options.cache } : {}
 	});
-	if (outgoing) ctx.log(`   ${urlKey} holds the new key. Deploy '${ctx.stage}' now; the next gkm setup --stage ${ctx.stage} after that deploy deletes the old key ${outgoing}`);
-}
-/**
-* Each provisioned bucket answers `HeadBucket` to the key in the stage's
-* secrets — the one the apps will use. A bucket whose URL carries no key is
-* not one this provider wrote, and the deploy's own check covers a URL that
-* is missing.
-*/
-async function verifyS3(ctx) {
-	const S3 = await import("@aws-sdk/client-s3");
-	for (const { id } of bucketConstructs(ctx.manifest)) {
-		const url = ctx.secrets[provideKey(id, "url")];
-		if (url === void 0) continue;
-		const address = s3Url.parse(url);
-		if (!address.accessKeyId || !address.secretAccessKey) continue;
-		const client = new S3.S3Client({
-			region: address.region ?? ctx.config.region ?? "us-east-1",
-			credentials: {
-				accessKeyId: address.accessKeyId,
-				secretAccessKey: address.secretAccessKey
-			},
-			...address.endpoint ? { endpoint: address.endpoint } : {},
-			...address.forcePathStyle ? { forcePathStyle: true } : {}
-		});
-		try {
-			await client.send(new S3.HeadBucketCommand({ Bucket: address.bucket }));
-		} catch (error) {
-			const name = errorName(error);
-			throw new ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, name === "NotFound" ? "it does not exist" : name === "Forbidden" ? "the key is refused" : name || String(error));
-		} finally {
-			client.destroy();
-		}
-	}
-}
-//#endregion
-//#region src/providers/registry.ts
-/**
-* The providers gkm ships, by kind and name — registered the way a deploy
-* target's built-ins are (`target/builtins.ts`). A provider from a package is
-* one more entry here once there is a loading story for it.
-*/
-const BUILTIN_PROVIDERS = { objects: { s3: {
-	kind: "objects",
-	name: "s3",
-	check: checkS3Config,
-	provisioning: S3_PROVISIONING,
-	credentials: awsProvisioningCredentials,
-	runtimeKeys(manifest) {
-		return bucketConstructs(manifest).flatMap((b) => [provideKey(b.id, "url"), ...b.servers.map((s) => provideKey(s.id, "url"))]);
-	},
-	ensure: ensureS3,
-	verify: verifyS3
-} } };
-/** The provider `kind` names `name`, if gkm has one. */
-function builtinProvider(kind, name) {
-	return Object.hasOwn(BUILTIN_PROVIDERS[kind], name) ? BUILTIN_PROVIDERS[kind][name] : void 0;
-}
-//#endregion
-//#region src/providers/index.ts
-/** The constructs of a kind: `objects` is every bucket. */
-function constructsOf(manifest, kind) {
-	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
 }
 /**
-* What every deploy runs: each provider's `verify()` — the cheap check that
-* what it created is still there and the stage's key reaches it. Nothing on
-* the local stage, and nothing for a kind on `external`.
+* A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
-* @throws {StageProviderDisabled} for a declared kind the stage has none of
+* The keys come from the site's declaration where there is one — every
+* public key its edges give it, `VITE_UPLOADS_SERVER_URL` included — and an
+* `ARG` the Dockerfile does not declare is a build argument the build drops,
+* leaving the bundle with an empty URL.
 */
-async function verifyStageProviders(input) {
-	assertStageProvidersEnabled(input.workspace, input.manifest, input.stage);
-	const verified = [];
-	for (const kind of PROVIDER_KINDS) {
-		if (constructsOf(input.manifest, kind).length === 0) continue;
-		const choice = stageProvider(input.workspace, kind, input.stage);
-		if (choice.mode !== "provider") continue;
-		const provider = builtinProvider(kind, choice.name);
-		await provider.verify({
-			workspace: input.workspace,
-			manifest: input.manifest,
-			stage: input.stage,
-			config: choice.config,
-			secrets: input.secrets
-		});
-		verified.push(`${kind}: ${provider.name}`);
-	}
-	return verified;
-}
-/**
-* `ensure()` for every provider the stage configures — find or create, fix
-* drift, record in the stage's state, write the runtime keys into its
-* secrets. A provider without provisioning credentials leaves the stage as
-* `external` and says how to supply them.
-*/
-async function provisionStage(options) {
-	const { workspace, stage } = options;
-	const dryRun = options.dryRun === true;
-	const env = options.env ?? process.env;
-	const log = options.log ?? ((line) => console.log(line));
-	const named = PROVIDER_KINDS.some((kind) => stageProvider(workspace, kind, stage).mode === "provider");
-	let found = options.manifest;
-	let runnables = options.runnables ?? {};
-	if (!found && named) {
-		runnables = {};
-		found = await discover({
-			patterns: constructGlobs(workspace),
-			cwd: workspace.root,
-			runnables
-		});
-	}
-	const manifest = found ?? {};
-	const reports = [];
-	const configured = [];
-	for (const kind of PROVIDER_KINDS) {
-		const choice = stageProvider(workspace, kind, stage);
-		if (choice.mode !== "provider") {
-			reports.push({
-				kind,
-				mode: choice.mode,
-				actions: []
-			});
-			continue;
-		}
-		const provider = builtinProvider(kind, choice.name);
-		const report = {
-			kind,
-			mode: "provider",
-			provider: provider.name,
-			actions: []
-		};
-		reports.push(report);
-		if (constructsOf(manifest, kind).length === 0) {
-			log(`   ${kind}: ${provider.name} — nothing declared to provision`);
-			continue;
-		}
-		const credential = await provider.credentials({
-			stage,
-			env,
-			...options.profile ? { profile: options.profile } : {},
-			...options.home ? { home: options.home } : {}
-		});
-		report.credentials = credential !== void 0;
-		if (credential === void 0) {
-			log(`   ${kind}: ${provider.name} — no credentials to provision with, so '${stage}' is external for now: its keys (${provider.runtimeKeys(manifest).join(", ")}) are yours to set with gkm secrets:add --stage ${stage}. To have gkm create them, supply ${provider.provisioning.describe}` + (provider.provisioning.login ? `, or run gkm login --provider ${provider.provisioning.login}` : "") + `, and run ${provisionCommand(stage)}.`);
-			continue;
-		}
-		configured.push({
-			kind,
-			provider,
-			config: choice.config,
-			credential,
-			report
-		});
-	}
-	if (configured.length === 0) return reports;
-	const identity = deployIdentity(workspace, stage);
-	const secretsStore = await secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	});
-	let secrets = (await secretsStore.read(stage))?.custom ?? {};
-	const stateStore = await createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	const lock = dryRun ? void 0 : await stateStore.lock(stage, { operation: "provision" });
-	try {
-		const state = dryRun ? await readOnlyState(stateStore, stage) : journalState(await DeployJournal.open(stateStore, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
-		const writeSecrets = async (values) => {
-			if (dryRun) return;
-			const stored = await secretsStore.read(stage) ?? initStageSecrets(stage);
-			const next = {
-				...stored,
-				custom: {
-					...stored.custom,
-					...values
-				},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
-			await secretsStore.write(stage, next);
-			secrets = next.custom;
-		};
-		for (const entry of configured) {
-			log(`   ${entry.kind}: ${entry.provider.name}${dryRun ? " (dry run)" : ""}`);
-			await entry.provider.ensure({
-				workspace,
-				manifest,
-				runnables,
-				stage,
-				identity,
-				config: entry.config,
-				credential: entry.credential,
-				get secrets() {
-					return secrets;
-				},
-				state,
-				dryRun,
-				rotateKeys: options.rotateKeys === true,
-				retireOldKeys: options.retireOldKeys === true,
-				async change(action, apply) {
-					if (!dryRun) await apply();
-					entry.report.actions.push(action);
-					log(`   ${dryRun ? "would " : ""}${action.change} — ${action.resource}`);
-				},
-				writeSecrets,
-				log
-			});
-			if (entry.report.actions.length === 0) log("   up to date");
-		}
-	} finally {
-		await lock?.release();
-	}
-	return reports;
-}
-/** The journal as `ensure()` sees it. */
-function journalState(journal) {
-	return {
-		record: (key) => journal.record(key),
-		pending: (entry) => journal.pending(entry),
-		ready: (entry, id) => journal.ready(entry, id),
-		lastDeployedAt: journal.existed ? journal.state.lastDeployedAt : void 0
-	};
-}
-/** What a dry run reads, and the writes it does not make. */
-async function readOnlyState(store, stage) {
-	const stored = await store.read(stage);
-	return {
-		record: (key) => stored?.resources[key],
-		pending: async () => {},
-		ready: async () => {},
-		...stored ? { lastDeployedAt: stored.state.lastDeployedAt } : {}
+function siteDockerfile(appName, app, options) {
+	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && appKey(id) === appName)?.[1] : void 0;
+	const publicUrlArgs = options.publicUrlArgs ?? (declared?.kind === "site" && options.manifest ? Object.keys(publicEnvFor(declared, options.manifest)) : getPublicUrlArgNames(app));
+	const webOpts = {
+		...options.image,
+		publicUrlArgs
 	};
-}
-//#endregion
-//#region src/secrets/stale.ts
-/**
-* Stored secrets an older gkm generated that now shadow a derived value.
-*
-* Before constructs, initialising a stage wrote an address for each app into
-* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
-* URL with a password of its own, and `http://localhost:<port>` for a site or
-* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
-* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
-* — and a deploy derives them. A value the stage holds is a value set by hand,
-* and set by hand wins: the container is handed `localhost`, where nothing
-* answers, with a password no role has.
-*
-* So a deploy refuses such a stage rather than run it, naming each key and
-* the command that removes it. Nothing is deleted for the user: the value is
-* theirs, and only they can say it is stale. A URL that names a real host — a
-* managed database — is a deliberate choice and still wins.
-*/
-/** The kinds whose URL an older gkm wrote into a stage's secrets. */
-const ADDRESSED = /* @__PURE__ */ new Set([
-	"database",
-	"database-reader",
-	"database-schema",
-	"rest-api",
-	"site"
-]);
-/** Hosts that are this machine — never anything, inside a container. */
-const LOOPBACK = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]",
-	"::1"
-]);
-/**
-* A stage holds a construct's address as a custom secret, pointing at
-* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
-* generated. Set by hand wins over derived, so the app would be handed it.
-*/
-var StaleStageSecrets = class extends GkmError {
-	stage;
-	stale;
-	constructor(stage, stale) {
-		const one = stale.length === 1;
-		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
-A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
-		this.stage = stage;
-		this.stale = stale;
-		this.name = "StaleStageSecrets";
-	}
-};
-/** The host a stored value names, if it is a URL. */
-function hostOf(value) {
-	try {
-		return new URL(value).hostname;
-	} catch {
-		return;
+	switch (app.framework) {
+		case "vite": return generateViteStaticDockerfile(webOpts);
+		case "tanstack-start":
+		case "remix": return generateNodeWebDockerfile(webOpts);
+		default: return generateNextjsDockerfile(webOpts);
 	}
 }
 /**
-* Each stored key that a construct provides an address for, holding an
-* address on this machine.
+* What a build root's `.dockerignore` must leave out of every image's
+* context: dependencies installed for another platform, anything built on the
+* host (every image builds from source), git, and gkm's own output —
+* `.gkm/compose`'s env files hold a stage's secrets.
 */
-function staleStageSecrets(manifest, supplied) {
-	const stale = [];
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (!ADDRESSED.has(declaration.kind)) continue;
-		const key = providedKeyFor(id, declaration.kind, "url");
-		const value = supplied[key];
-		if (value === void 0) continue;
-		const host = hostOf(value);
-		if (host === void 0 || !LOOPBACK.has(host)) continue;
-		stale.push({
-			key,
-			construct: id,
-			host
-		});
+const REQUIRED_IGNORES = [
+	"**/node_modules",
+	".git",
+	"**/dist",
+	"**/.next",
+	"**/.turbo",
+	"**/.gkm",
+	"**/.gkm/compose"
+];
+/**
+* Make sure the build root's `.dockerignore` leaves out what no image may
+* hold: written whole where there is none, and each missing line appended to
+* one the project keeps.
+*/
+async function ensureDockerignore(buildRoot) {
+	const path = join(buildRoot, ".dockerignore");
+	if (!existsSync(path)) {
+		await writeFile(path, generateDockerignore());
+		return path;
 	}
-	return stale.sort((a, b) => a.key.localeCompare(b.key));
+	const current = await readFile(path, "utf-8");
+	const lines = new Set(current.split(/\r?\n/).map((line) => line.trim()));
+	const missing = REQUIRED_IGNORES.filter((line) => !lines.has(line));
+	if (missing.length === 0) return path;
+	await appendFile(path, `${current.endsWith("\n") || current === "" ? "" : "\n"}\n# gkm: images build from source, and a stack's env files hold its secrets\n${missing.join("\n")}\n`);
+	return path;
 }
 /**
-* Refuse a stage whose stored secrets would shadow a construct's address with
-* `localhost`.
+* Write `docker-compose.constructs.yml` — the same file `gkm dev` writes, with
+* the apps beside the containers their constructs derive.
 *
-* @throws {StaleStageSecrets} naming each key and the command removing it
+* Through reconcile rather than a second generator, so what `gkm docker`
+* describes and what `gkm dev` runs cannot disagree. Nothing is started.
 */
-function assertNoStaleSecrets(options) {
-	const stale = staleStageSecrets(options.manifest, options.supplied);
-	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
+async function writeConstructsCompose(workspace) {
+	await reconcileWorkspace(workspace, {
+		stage: workspace.stages.local,
+		start: false
+	});
+	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	return join(workspace.root, COMPOSE_PATH);
+}
+function printRunInstructions(workspace) {
+	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
+	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger.log("   gkm setup   # starts the containers and creates what they hold");
+	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/target/seeds.ts
@@ -10372,6 +8232,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { contentVersion as $, projectKey as $n, bucketClient as $t, orchestrateDns as A, telemetryOf as An, workspace_exports as At, setBackupState as B, findAvailablePort as Bn, stackRedis as Bt, HostNotPointingAtServer as C, planFor as Cn, QueueGenerator as Ct, serverAddressHint as D, isTelemetryKey as Dn, constructGlobs as Dt, requiredServerAddress as E, appTelemetry as En, backendsOf as Et, getBackupState as F, portKeys as Fn, withGeneratedSecrets as Ft, LocalStateInCi as G, prepareEntryCredentials as Gn, applyPolicies as Gt, setPostgresBackupId as H, loadEnvFiles as Hn, LOCAL_CA_PATH as Ht, getGeneratedSecret as I, portsOf as In, REDIS_SERVICE as It, StateStoreBusy as J, storeFromConfig as Jn, postgresDatabaseNames as Jt, StageStateMissing as K, isRemoteStore as Kn, applyPostgres as Kt, recordRelease as L, primaryPortKey as Ln, STACK_CACHE as Lt, asDokployState as M, DEFAULT_IMAGES as Mn, loadLocalCredentials as Mt, createComposeState as N, describeServices as Nn, postgresSuperuser as Nt, stackHosts as O, scopeTelemetryEnv as On, derivedContainers as Ot, createEmptyState as P, fakeKey as Pn, readLocalCredentials as Pt, assertStateOutlivesRun as Q, keystoreProject as Qn, ensurePostgresLogin as Qt, recordRollback as R, createCredentialsPreload as Rn, redisService as Rt, validateImageRef as S, TELEMETRY_CONTAINER as Sn, resolveHost as Sr, workerEntryDir as St, isLocalHost as T, hostFor as Tn, FAKE_ENV as Tt, DnsRecordsUnreadable as U, loadPortState as Un, forgetState as Ut, setGeneratedSecret as V, isPortAvailable as Vn, withRedisPassword as Vt, DocumentStateStore as W, loadSecretsForApp as Wn, applyBuckets as Wt, StateVersionConflict as X, FileSecretsStore as Xn, quoteIdentifier as Xt, StateStoreWithoutLocking as Y, store_exports as Yn, postgresStatements as Yt, appendHistory as Z, getKeyPath as Zn, LEGACY_LOCAL_LOGIN as Zt, appDockerfile as _, providerOf as _n, logsService as _r, requiredStageKeys as _t, provisionStage as a, envFor as an, isOwnedBy as ar, describeActor as at, workerDockerfile as b, composeFor as bn, NoDomainForStage as br, WorkerGenerator as bt, deploysWithCompose as c, imageLayout as cn, projectName as cr, DevServicesNeedServerTarget as ct, StageProviderDisabled as d, detectPackageManager as dn, storage_exports as dr, assertDevServicesFlag as dt, pgClient as en, readKey as er, createStateStore as et, assertStageProvidersEnabled as f, findBuildRoot as fn, toEmbeddableSecrets as fr, assertExternalServices as ft, DockerPushFailed as g, eventsBackendFor as gn, logsAccess as gr, reportDevServices as gt, DockerBuildFailed as h, cacheBackendFor as hn, LOGS_SERVICE as hr, manifestServiceDeclarations as ht, assertNoStaleSecrets as i, workerEnvKeys as in, imageRef as ir, currentActor as it, verifyDnsRecords as j, usesTelemetry as jn, LOCAL_RABBITMQ_USER as jt, systemLookup as k, surfaceClientTraced as kn, reconcileWorkspace as kt, provisionStageDns as l, TURBO_VERSION as ln, initStageSecrets as lr, ExternalServicesNotConfigured as lt, stageProviderNotes as m, isImageBuild as mn, LOCAL_LOGS_EMAIL as mr, externalServices as mt, reportDatabaseRuns as n, dockerfileOf as nn, deployIdentity as nr, upgradeV2State as nt, verifyStageProviders as o, localRolePassword as on, markerOf as or, AllowDevServicesTakesNoValue as ot, provisionCommand as p, imageBuildCredentials as pn, withCustomSecret as pr, devServicesUsed as pt, StateLocked as q, secretsStoreFor as qn, bucketPolicies as qt, reportPlannedSeeds as r, networkEnv as rn, imageName as rr, dnsResources as rt, assertStageServer as s, composeBuildPaths as sn, ownershipMarker as sr, DEV_SERVICES as st, DeploySeedsFailed as t, appEnvKeys as tn, applicationName as tr, newLockHolder as tt, DeployJournal as u, WORKER_PORT as un, maskPassword as ur, STORAGE_KEY_PAIR as ut, dockerCommand as v, storageBackendFor as vn, stackLogs as vr, suppliedOnly as vt, checkStackDns as w, resourceName as wn, CronGenerator as wt, workerDockerfileOf as x, EMULATOR_ACCESS_KEY_ID as xn, isMainFrontendApp as xr, workerBundleName as xt, ensureDockerignore as y, CLUSTER_DATABASE as yn, withLogsPassword as yr, workerUnits as yt, setApplicationId as z, createEntryWrapper as zn, runsRedis as zt };
+export { createDnsProvider as $, stackLogs as $n, storageBackendFor as $t, StageProviderDisabled as A, store_exports as An, postgresStatements as At, verifyDnsRecords as B, isOwnedBy as Bn, envFor as Bt, assertDevServicesFlag as C, loadEnvFiles as Cn, LOCAL_CA_PATH as Ct, requiredStageKeys as D, isRemoteStore as Dn, applyPostgres as Dt, reportDevServices as E, prepareEntryCredentials as En, applyPolicies as Et, DeployJournal as F, readKey as Fn, pgClient as Ft, getGeneratedSecret as G, maskPassword as Gn, WORKER_PORT as Gt, createComposeState as H, ownershipMarker as Hn, composeBuildPaths as Ht, extractSubdomain as I, applicationName as In, appEnvKeys as It, setApplicationId as J, withCustomSecret as Jn, imageBuildCredentials as Jt, recordRelease as K, storage_exports as Kn, detectPackageManager as Kt, findRootDomain as L, deployIdentity as Ln, dockerfileOf as Lt, provisionCommand as M, getKeyPath as Mn, LEGACY_LOCAL_LOGIN as Mt, stageProviderNotes as N, keystoreProject as Nn, ensurePostgresLogin as Nt, stageServiceDeclarations as O, secretsStoreFor as On, bucketPolicies as Ot, PROVIDER_KINDS as P, projectKey as Pn, bucketClient as Pt, DnsRecordsUnreadable as Q, logsService as Qn, providerOf as Qt, normalizeDnsConfig as R, imageName as Rn, networkEnv as Rt, STORAGE_KEY_PAIR as S, isPortAvailable as Sn, withRedisPassword as St, externalServices as T, loadSecretsForApp as Tn, applyBuckets as Tt, createEmptyState as U, projectName as Un, imageLayout as Ut, asDokployState as V, markerOf as Vn, localRolePassword as Vt, getBackupState as W, initStageSecrets as Wn, TURBO_VERSION as Wt, setGeneratedSecret as X, LOGS_SERVICE as Xn, cacheBackendFor as Xt, setBackupState as Y, LOCAL_LOGS_EMAIL as Yn, isImageBuild as Yt, setPostgresBackupId as Z, logsAccess as Zn, eventsBackendFor as Zt, isCi as _, portsOf as _n, REDIS_SERVICE as _t, DockerPushFailed as a, resourceName as an, CronGenerator as at, DevServicesNeedServerTarget as b, createEntryWrapper as bn, runsRedis as bt, ensureDockerignore as c, isTelemetryKey as cn, constructGlobs as ct, validateImageRef as d, telemetryOf as dn, workspace_exports as dt, CLUSTER_DATABASE as en, withLogsPassword as er, workerUnits as et, dnsRecordResource as f, usesTelemetry as fn, LOCAL_RABBITMQ_USER as ft, describeActor as g, portKeys as gn, withGeneratedSecrets as gt, currentActor as h, fakeKey as hn, readLocalCredentials as ht, DockerBuildFailed as i, planFor as in, QueueGenerator as it, assertStageProvidersEnabled as j, FileSecretsStore as jn, quoteIdentifier as jt, suppliedOnly as k, storeFromConfig as kn, postgresDatabaseNames as kt, workerDockerfile as l, scopeTelemetryEnv as ln, derivedContainers as lt, recordDnsChanges as m, describeServices as mn, postgresSuperuser as mt, reportDatabaseRuns as n, EMULATOR_ACCESS_KEY_ID as nn, isMainFrontendApp as nr, workerBundleName as nt, appDockerfile as o, hostFor as on, FAKE_ENV as ot, dnsResources as p, DEFAULT_IMAGES as pn, loadLocalCredentials as pt, recordRollback as q, toEmbeddableSecrets as qn, findBuildRoot as qt, reportPlannedSeeds as r, TELEMETRY_CONTAINER as rn, resolveHost as rr, workerEntryDir as rt, dockerCommand as s, appTelemetry as sn, backendsOf as st, DeploySeedsFailed as t, composeFor as tn, NoDomainForStage as tr, WorkerGenerator as tt, workerDockerfileOf as u, surfaceClientTraced as un, reconcileWorkspace as ut, AllowDevServicesTakesNoValue as v, primaryPortKey as vn, STACK_CACHE as vt, devServicesUsed as w, loadPortState as wn, forgetState as wt, ExternalServicesNotConfigured as x, findAvailablePort as xn, stackRedis as xt, DEV_SERVICES as y, createCredentialsPreload as yn, redisService as yt, orchestrateDns as z, imageRef as zn, workerEnvKeys as zt };
 
-//# sourceMappingURL=seeds-BSL55F6q.mjs.map
+//# sourceMappingURL=seeds-CoKkrSny.mjs.map