@geekmidas/cli 10.0.0-alpha.94 → 10.0.0-alpha.95

package/dist/{seeds-BCg8X36S.cjs → seeds-CnXkgKUv.cjs}

@@ -1,13 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-cSyi5nb1.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
-const require_resolve = require("./resolve-CFEOtRsl.cjs");
+const require_resolve = require("./resolve-CFb4Navi.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -609,7 +609,7 @@ function folderName(path) {
 function getKeystoreDir(project) {
 	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
 	const [namespace, name] = project.key.split("/");
-	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "keys", namespace, name);
+	return (0, node_path.join)(project.home ?? require_run.gkmHome(), "keys", namespace, name);
 }
 /** Get the path to a stage's encryption key. */
 function getKeyPath(stage, project) {
@@ -626,7 +626,7 @@ function legacyKeyPaths(stage, project) {
 		key,
 		home: project.home
 	}));
-	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_credentials.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_run.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
 	const names = (project.legacy ?? []).filter(isLegacyName);
 	return [...aliases, ...names.flatMap((name) => homes.map((home) => (0, node_path.join)(home, name, `${stage}.key`)))];
 }
@@ -5636,7 +5636,7 @@ function localCredentialsPath(project) {
 	const keys = getKeystoreDir(project);
 	const name = keys.split(/[\\/]/).at(-1);
 	const namespace = keys.split(/[\\/]/).at(-2);
-	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "local", namespace, `${name}.json`);
+	return (0, node_path.join)(project.home ?? require_run.gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
 var LocalCredentialsKeyMissing = class extends require_errors.GkmError {
@@ -6669,7 +6669,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-OdQmKXE3.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-DR1iws1P.cjs"));
 		return new HostingerProvider(options.hostinger);
 	}
 	if (provider === "route53") {
@@ -6682,7 +6682,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-DzguxU_a.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-C_DgIkMv.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7249,644 +7249,121 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
-//#region src/compose/dns.ts
-/**
-* A compose stage's DNS: the records its public hosts need, and the check that
-* they resolve to its server before a certificate is asked for.
-*
-* - **The server** (`serverAddress`): the stage's own secrets hold its public
-*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
-*   Reserved for gkm: never handed to an app.
-* - **The plan** (`planStackDns`, pure): every public host the stack serves —
-*   its apex, each app, each file server, the public log UI — pointed at the
-*   server. An A record per host (and an AAAA with an IPv6 address), or, where
-*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
-*   record for the target and a CNAME to it for every other host but the
-*   apex, which DNS forbids a CNAME at.
-* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
-*   a record set at a time. A record with the right value is left alone; one
-*   with another value is replaced and the change printed. A `manual` domain
-*   is printed and nothing else. A dry run reads, prints and writes nothing.
-* - **The check** (`checkStackDns`): each host resolved with the system
-*   resolver. One that is not the server stops the deploy with
-*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
-*   for a certificate it cannot get — and use up the rate limit trying.
-* - **The step** (`stageDns`): all three, as every deploy runs them — the plan applied through each provider,
-*   what was written read back from the provider, and only the hosts no
-*   provider wrote resolved publicly. A brand-new name is never looked up
-*   before its record exists, so no resolver caches it as missing.
-*/
-/** The line that says how to set the server's address. */
-function serverAddressHint(stage) {
-	return `gkm secrets:set ${require_workspace.SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
-}
-/** A server address in the stage's secrets that is not an address. */
-var ServerAddressInvalid = class extends require_errors.GkmError {
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
 	stage;
-	key;
-	value;
-	constructor(stage, key, value) {
-		const ipv4 = key === require_workspace.SERVER_IPV4_KEY;
-		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
-		this.stage = stage;
-		this.key = key;
-		this.value = value;
-		this.name = "ServerAddressInvalid";
-	}
-};
-/**
-* A compose stage that serves real domains with no server address: its hosts
-* cannot be pointed or checked, and a certificate would be asked for blind.
-*/
-var ServerAddressMissing = class extends require_errors.GkmError {
-	stage;
-	domain;
-	constructor(stage, domain) {
-		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${require_workspace.SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${require_workspace.SERVER_IPV6_KEY} for an IPv6 address).`);
-		this.stage = stage;
-		this.domain = domain;
-		this.name = "ServerAddressMissing";
-	}
-};
-/**
-* The server's address from the stage's secrets, checked — `undefined` when
-* `GKM_SERVER_IPV4` is not set.
-*
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function serverAddress(stage, custom) {
-	const ipv4 = custom?.[require_workspace.SERVER_IPV4_KEY]?.trim();
-	const ipv6 = custom?.[require_workspace.SERVER_IPV6_KEY]?.trim();
-	if (ipv6 && !(0, node_net.isIPv6)(ipv6)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV6_KEY, ipv6);
-	if (!ipv4) return void 0;
-	if (!(0, node_net.isIPv4)(ipv4)) throw new ServerAddressInvalid(stage, require_workspace.SERVER_IPV4_KEY, ipv4);
-	return {
-		ipv4,
-		...ipv6 ? { ipv6 } : {}
-	};
-}
-/**
-* A name that resolves to this machine by definition — `localhost` and every
-* `*.localhost` — and is in nobody's DNS.
-*/
-function isLocalHost(host) {
-	const name = host.toLowerCase().replace(/\.$/, "");
-	return name === "localhost" || name.endsWith(".localhost");
-}
-/**
-* The server's address, required where the stage serves real domains — not
-* `*.localhost` ones, which point at this machine already.
-*
-* @throws {ServerAddressMissing} when the stage has a domain and no address
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function requiredServerAddress(stage, domain, custom) {
-	const server = serverAddress(stage, custom);
-	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
-	return server;
-}
-const MANAGED = [
-	"A",
-	"AAAA",
-	"CNAME"
-];
-/** Every public host the stack serves, once each, sorted. */
-function stackHosts(stack) {
-	return [...new Set(stack.routes.map((route) => route.host))].sort();
-}
-/** The TTL a domain's records are written with. */
-function recordTtl(config) {
-	const ttl = "ttl" in config ? config.ttl : void 0;
-	if (ttl) return ttl;
-	return config.provider === "godaddy" ? 600 : 300;
-}
-function providerName(config) {
-	return typeof config.provider === "string" ? config.provider : "custom";
-}
-/**
-* A wildcard host: gkm writes one record per public host, so a stage on
-* another server — or a name someone else points elsewhere — is never caught
-* by a record it did not ask for.
-*/
-var DnsWildcardRefused = class extends require_errors.GkmError {
-	stage;
-	host;
-	constructor(stage, host) {
-		super(`'${stage}' would point ${host} at its server, and gkm never writes a wildcard record: each public host gets its own. Give the app a subdomain of its own instead.`);
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
 		this.stage = stage;
-		this.host = host;
-		this.name = "DnsWildcardRefused";
-	}
-};
-/** The records a stage's hosts need — pure. */
-function planStackDns(input) {
-	const { stage, server } = input;
-	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
-	const records = /* @__PURE__ */ new Map();
-	const uncovered = [];
-	const add = (host, domain, type, value) => {
-		const name = extractSubdomain(host, domain);
-		records.set(`${domain} ${name} ${type}`, {
-			host,
-			domain,
-			name,
-			type,
-			value,
-			ttl: recordTtl(dns[domain])
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	static async open(store, stage, initial, adopt = (stored) => stored) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
 		});
-	};
-	const pointAt = (host, domain) => {
-		add(host, domain, "A", server.ipv4);
-		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
-	};
-	for (const raw of input.hosts) {
-		const host = raw.toLowerCase();
-		if (host.includes("*")) throw new DnsWildcardRefused(stage, host);
-		const domain = findRootDomain(host, dns);
-		if (!domain) {
-			uncovered.push(host);
-			continue;
-		}
-		const target = require_workspace.cnameTarget(dns[domain].records, stage);
-		if (target) pointAt(target, domain);
-		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
-		else pointAt(host, domain);
-	}
-	const domains = /* @__PURE__ */ new Map();
-	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
-		const config = dns[record.domain];
-		const plan = domains.get(record.domain) ?? {
-			domain: record.domain,
-			provider: providerName(config),
-			config,
-			records: []
-		};
-		plan.records.push(record);
-		domains.set(record.domain, plan);
 	}
-	return {
-		stage,
-		server,
-		domains: [...domains.values()],
-		uncovered: uncovered.sort()
-	};
-}
-/** Records a provider accepted and then did not read back with their value. */
-var DnsRecordsNotConfirmed = class extends require_errors.GkmError {
-	stage;
-	domain;
-	provider;
-	records;
-	constructor(stage, domain, provider, records) {
-		const lines = records.map((r) => `  - ${r.host} ${r.type}: ${r.found.length > 0 ? r.found.join(", ") : "nothing"}, expected ${r.expected}`);
-		super(`${provider} accepted '${stage}''s records for ${domain}, and reading them back does not show them:\n${lines.join("\n")}\nDeploy again; if it persists, check the records in the provider's console — another tool may be writing the same names.`);
-		this.stage = stage;
-		this.domain = domain;
-		this.provider = provider;
-		this.records = records;
-		this.name = "DnsRecordsNotConfirmed";
-	}
-};
-/** `api.example.com  A  203.0.113.10  (TTL 600)` */
-function describe(record) {
-	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
-}
-function printManual(plan, log, why) {
-	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
-	for (const record of plan.records) log(`     ${describe(record)}`);
-	return plan.records.map((r) => ({
-		domain: r.domain,
-		name: r.name,
-		type: r.type,
-		action: "manual",
-		value: r.value,
-		ttl: r.ttl
-	}));
-}
-/** The existing records of every planned name, for the types gkm manages. */
-async function existingRecords(provider, plan) {
-	const names = [...new Set(plan.records.map((r) => r.name))];
-	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
-		name,
-		type
-	})));
-	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
-	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
-}
-const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
-/**
-* What each domain's records need, compared with what is there: creates,
-* updates, and the deletes a change of mode needs — a name moving from an A
-* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
-*/
-function diffDomainDns(plan, existing) {
-	const changes = [];
-	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
-	const planned = /* @__PURE__ */ new Map();
-	for (const record of plan.records) {
-		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
-		types.add(record.type);
-		planned.set(record.name, types);
-	}
-	for (const [name, types] of planned) {
-		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
-		for (const type of conflicting) {
-			const found = find(name, type);
-			if (!found || found.values.length === 0) continue;
-			changes.push({
-				domain: plan.domain,
-				name,
-				type,
-				action: "delete",
-				previous: found.values.join(", ")
-			});
-		}
-	}
-	for (const record of plan.records) {
-		const found = find(record.name, record.type);
-		const base = {
-			domain: plan.domain,
-			name: record.name,
-			type: record.type,
-			value: record.value,
-			ttl: record.ttl
-		};
-		if (!found || found.values.length === 0) changes.push({
-			...base,
-			action: "create"
-		});
-		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
-			...base,
-			action: "unchanged"
-		});
-		else changes.push({
-			...base,
-			action: "update",
-			previous: found.values.join(", ")
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
 		});
 	}
-	return changes;
-}
-/** A host's full name from a domain and a relative name. */
-function fullName(domain, name) {
-	return name === "@" ? domain : `${name}.${domain}`;
-}
-function printChange(change, dryRun, log) {
-	const host = fullName(change.domain, change.name).padEnd(32);
-	const type = change.type.padEnd(5);
-	const would = dryRun ? "would " : "";
-	switch (change.action) {
-		case "unchanged":
-			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
-			break;
-		case "create":
-			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
-			break;
-		case "update":
-			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
-			break;
-		case "write":
-			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
-			break;
-		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
-	}
-}
-/**
-* Each domain's records, through its provider — and, with `confirm`, what was
-* written read back from it. A record already holding its value is neither
-* written nor read again.
-*
-* @throws {DnsRecordsNotConfirmed} when a written record does not read back
-*/
-async function settleStackDns(plan, options = {}) {
-	const dryRun = options.dryRun === true;
-	const log = options.log ?? ((line) => console.log(line));
-	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
-		config,
-		...options.credentials ? { godaddy: options.credentials } : {},
-		...options.hostinger ? { hostinger: options.hostinger } : {}
-	}));
-	const changes = [];
-	const confirmed = /* @__PURE__ */ new Set();
-	const unconfirmed = /* @__PURE__ */ new Set();
-	const hostsOf = (domain) => new Set(domain.records.map((r) => r.host));
-	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
-	for (const domain of plan.domains) {
-		if (domain.provider === "manual") {
-			changes.push(...printManual(domain, log, "manual"));
-			for (const host of hostsOf(domain)) unconfirmed.add(host);
-			continue;
-		}
-		const provider = await providerFor(domain.config);
-		if (!provider) {
-			changes.push(...printManual(domain, log, "manual"));
-			for (const host of hostsOf(domain)) unconfirmed.add(host);
-			continue;
-		}
-		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
-		let existing;
-		let diff;
-		let unreadable = false;
-		try {
-			existing = await existingRecords(provider, domain);
-			diff = diffDomainDns(domain, existing);
-		} catch (error) {
-			if (!(error instanceof DnsRecordsUnreadable)) throw error;
-			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
-			unreadable = true;
-			existing = [];
-			diff = domain.records.map((r) => ({
-				domain: r.domain,
-				name: r.name,
-				type: r.type,
-				action: "write",
-				value: r.value,
-				ttl: r.ttl
-			}));
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
 		}
-		for (const change of diff) printChange(change, dryRun, log);
-		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
-			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
-			const planned = domain.records.find((r) => r.name === name && r.type === "A");
-			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${require_workspace.SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
 		}
-		changes.push(...diff);
-		const written = new Set(diff.filter((c) => c.action !== "unchanged").map((c) => fullName(c.domain, c.name)));
-		for (const host of hostsOf(domain)) if (unreadable) {
-			if (!dryRun) unconfirmed.add(host);
-		} else if (!written.has(host)) confirmed.add(host);
-		if (dryRun) continue;
-		const deletes = diff.filter((c) => c.action === "delete");
-		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
-			name: c.name,
-			type: c.type
-		})));
-		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
-		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
-			name: c.name,
-			type: c.type,
-			value: c.value,
-			ttl: c.ttl
-		})));
-		if (!options.confirm || unreadable || written.size === 0) continue;
-		const rewritten = {
-			...domain,
-			records: domain.records.filter((r) => written.has(r.host))
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
 		};
-		const after = await existingRecords(provider, rewritten);
-		const missing = [];
-		for (const record of rewritten.records) {
-			const values = after.find((r) => r.name === record.name && r.type === record.type)?.values ?? [];
-			if (values.length !== 1 || !same(values[0], record.value)) missing.push({
-				host: record.host,
-				type: record.type,
-				expected: record.value,
-				found: values
-			});
-		}
-		if (missing.length > 0) throw new DnsRecordsNotConfirmed(plan.stage, domain.domain, provider.name, missing);
-		for (const host of written) confirmed.add(host);
-		log(`   ✓ ${written.size} host${written.size === 1 ? "" : "s"} read back from ${provider.name}`);
-	}
-	for (const host of plan.uncovered) unconfirmed.add(host);
-	return {
-		changes,
-		confirmed: [...confirmed].sort(),
-		unconfirmed: [...unconfirmed].filter((h) => !confirmed.has(h)).sort()
-	};
-}
-/** The system resolver: what the server's own clients would be told. */
-const systemLookup = async (host) => {
-	return (await (0, node_dns_promises.lookup)(host, { all: true })).map((a) => a.address);
-};
-/** Hosts that do not resolve to the stage's server. */
-var HostNotPointingAtServer = class extends require_errors.GkmError {
-	stage;
-	hosts;
-	expected;
-	fix;
-	constructor(stage, hosts, expected, fix) {
-		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
-		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
-		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns.`);
-		this.stage = stage;
-		this.hosts = hosts;
-		this.expected = expected;
-		this.fix = fix;
-		this.name = "HostNotPointingAtServer";
-	}
-};
-/**
-* Every host resolved: each must resolve to the server's IPv4 address and to
-* nothing but the server's addresses.
-*
-* @throws {HostNotPointingAtServer} naming every host that does not
-*/
-async function checkStackDns(input) {
-	const lookup = input.lookup ?? systemLookup;
-	const { server } = input;
-	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
-	const bad = [];
-	const ok = [];
-	for (const host of input.hosts) {
-		let resolved;
-		try {
-			resolved = [...new Set(await lookup(host))];
-		} catch (error) {
-			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
-			bad.push({
-				host,
-				resolved: [],
-				error: code
-			});
-			continue;
-		}
-		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
-		else bad.push({
-			host,
-			resolved
-		});
 	}
-	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
-		ipv4: server.ipv4,
-		...server.ipv6 ? { ipv6: server.ipv6 } : {}
-	}, dnsFix(input, bad));
-	return ok;
-}
-/** How to fix it: the deploy, or the records to create by hand. */
-function dnsFix(input, bad) {
-	const hosts = bad.map((h) => h.host);
-	let plan;
-	try {
-		plan = planStackDns({
-			stage: input.stage,
-			hosts,
-			server: input.server,
-			dns: input.dns
-		});
-	} catch {
-		plan = {
-			stage: input.stage,
-			server: input.server,
-			domains: [],
-			uncovered: hosts
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
 		};
 	}
-	const automatic = plan.domains.filter((d) => d.provider !== "manual");
-	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
-	const lines = [];
-	if (automatic.length > 0) lines.push(`Fix: gkm deploy --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} through their provider (--dry-run shows them first).`);
-	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
-	return lines.join("\n");
-}
-/** The environment variable each token-authenticated provider reads. */
-const DNS_TOKEN_KEYS = {
-	godaddy: "GODADDY_API_TOKEN",
-	hostinger: "HOSTINGER_API_TOKEN"
-};
-/**
-* A domain whose records the deploy writes, and no token to write them with.
-* Raised before anything is built, started or written.
-*/
-var DnsCredentialMissing = class extends require_errors.GkmError {
-	stage;
-	domain;
-	provider;
-	key;
-	constructor(stage, domain, provider, key) {
-		super(`'${stage}''s hosts are under ${domain}, whose DNS is ${provider}'s, and the deploy writes their records — but ${key} is not set. In CI, add ${key} as a secret on the '${stage}' GitHub environment and pass it to the step that writes the records: env: { ${key}: \${{ secrets.${key} }} }. On this machine, export ${key} or run gkm login --provider ${provider}. With a CDN or proxy in front of the server, pass --skip-dns.`);
-		this.stage = stage;
-		this.domain = domain;
-		this.provider = provider;
-		this.key = key;
-		this.name = "DnsCredentialMissing";
-	}
 };
-/**
-* The `dns` domain a stage's own domain (`domains.<stage>`) is under — where
-* its hosts' records go — or none.
-*/
-function stageDnsDomains(stage, domains, dns) {
-	const own = domains?.[stage];
-	if (!own || !dns || isLocalHost(own)) return [];
-	const normalized = normalizeDnsConfig(dns);
-	const root = findRootDomain(own.toLowerCase(), normalized);
-	return root ? [{
-		domain: root,
-		config: normalized[root]
-	}] : [];
-}
-/**
-* Each token the domains' providers need, from `credentials` — `manual`,
-* Route53 (the AWS SDK's own chain) and a provider object need none.
-*
-* @throws {DnsCredentialMissing} naming the first domain with no token
-*/
-async function dnsCredentials(stage, domains, credentials) {
-	const found = {};
-	for (const { domain, config } of domains) {
-		const provider = config.provider;
-		if (provider !== "godaddy" && provider !== "hostinger") continue;
-		if (found[provider]) continue;
-		const token = await credentials.get({ kind: provider });
-		if (!token?.token) throw new DnsCredentialMissing(stage, domain, provider, DNS_TOKEN_KEYS[provider]);
-		found[provider] = token;
-	}
-	return found;
-}
-/**
-* A stage's DNS, as every deploy runs it: the
-* stage's own hosts planned, written through each domain's provider where
-* they differ, and read back from it. Only A, AAAA and CNAME records of
-* those names are touched; nothing is a wildcard, and no other name is read,
-* written or deleted. What no provider confirms — a `manual` domain, a host
-* under no domain in `dns`, a key that cannot read — is resolved publicly.
-* A dry run prints the plan and writes nothing.
-*
-* @throws {DnsCredentialMissing} before anything is read or written
-* @throws {DnsRecordsNotConfirmed} when a written record does not read back
-* @throws {HostNotPointingAtServer} when a resolved host is not the server
-*/
-async function stageDns(input) {
-	const { stage, server } = input;
-	const log = input.log ?? ((line) => console.log(line));
-	const plan = planStackDns({
-		stage,
-		hosts: input.hosts,
-		server,
-		dns: input.dns
-	});
-	const tokens = await dnsCredentials(stage, plan.domains.map(({ domain, config }) => ({
-		domain,
-		config
-	})), input.credentials);
-	const applied = !input.dns ? {
-		changes: [],
-		confirmed: [],
-		unconfirmed: [...plan.uncovered]
-	} : await settleStackDns(plan, {
-		...input.dryRun ? { dryRun: true } : { confirm: true },
-		log,
-		credentials: {
-			...input.godaddy ?? {},
-			...tokens.godaddy ? { credential: tokens.godaddy } : {},
-			log
-		},
-		...tokens.hostinger ? { hostinger: tokens.hostinger } : {},
-		...input.providerFor ? { providerFor: input.providerFor } : {}
-	});
-	let resolved = [];
-	if (applied.unconfirmed.length > 0) resolved = await checkStackDns({
-		stage,
-		hosts: applied.unconfirmed,
-		server,
-		dns: input.dns,
-		...input.lookup ? { lookup: input.lookup } : {}
-	});
-	return {
-		plan,
-		changes: applied.changes,
-		confirmed: applied.confirmed,
-		resolved
-	};
-}
-//#endregion
-//#region src/providers/dns.ts
-var dns_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	composeStageHosts: () => composeStageHosts,
-	deploysWithCompose: () => deploysWithCompose
-});
-/** Whether the workspace deploys through the compose target. */
-function deploysWithCompose(workspace) {
-	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
-}
-/**
-* The hosts a compose stage serves: its stack composed as a deploy would —
-* with the secrets it would generate made up in memory, never written — and
-* every route's host read off it.
-*/
-async function composeStageHosts(options) {
-	const { workspace, stage, manifest } = options;
-	const { deployedStackSecrets } = await Promise.resolve().then(() => require("./secrets-DAvi_O9g.cjs")).then((n) => n.secrets_exports);
-	const { composeStack } = await Promise.resolve().then(() => require("./stack-B3fPDTBg.cjs")).then((n) => n.stack_exports);
-	const { secrets } = deployedStackSecrets(workspace, stage, options.stored, manifest);
-	return stackHosts(composeStack({
-		workspace,
-		manifest,
-		runnables: options.runnables,
-		background: options.background,
-		stage,
-		identity: deployIdentity(workspace, stage),
-		images: {
-			mode: "pull",
-			tag: "dns",
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
-		},
-		secrets,
-		buildOnly: true,
-		allowDevServices: true
-	}));
-}
 //#endregion
 //#region src/providers/types.ts
 /** The manifest kinds a stage can name a provider for. */
@@ -7952,88 +7429,6 @@ function assertStageProvidersEnabled(workspace, manifest, stage) {
 		if (require_workspace.stageProvider(workspace, kind, stage).mode === "none") throw new StageProviderDisabled(kind, stage, ids);
 	}
 }
-const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
-/** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends require_errors.GkmError {
-	bucket;
-	reason;
-	constructor(bucket, reason) {
-		super(`'${bucket}' is not a valid S3 bucket name: ${reason}. Rename the construct or set deploy.namespace in gkm.config.ts to something that leaves room for it.`);
-		this.bucket = bucket;
-		this.reason = reason;
-		this.name = "InvalidBucketName";
-	}
-};
-/** Lowercase `[a-z0-9-]`, runs of anything else one `-`, no edge dashes. */
-function part(value) {
-	return (0, _geekmidas_manifest.kebabCase)(value).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/**
-* `parts` joined by `-`, shortened to `max` characters by trimming the longest
-* part one character at a time — so a long construct id gives way before a
-* short stage name does, and every part keeps its start.
-*/
-function fitParts(parts, max) {
-	const kept = parts.map(part).filter(Boolean);
-	const length = () => kept.reduce((sum, p) => sum + p.length, 0) + kept.length - 1;
-	while (length() > max) {
-		let longest = 0;
-		for (let i = 1; i < kept.length; i++) if (kept[i].length > kept[longest].length) longest = i;
-		if (kept[longest].length <= 1) break;
-		kept[longest] = kept[longest].slice(0, -1).replace(/-+$/, "");
-	}
-	return kept.join("-");
-}
-/** Why `name` is not a valid bucket name, or undefined when it is. */
-function bucketNameProblem(name) {
-	if (name.length < 3 || name.length > 63) return `it is ${name.length} characters, and S3 takes 3 to 63`;
-	if (!/^[a-z0-9-]+$/.test(name)) return "it may hold only lowercase letters, digits and -";
-	if (!/^[a-z0-9].*[a-z0-9]$/.test(name)) return "it must start and end with a letter or a digit";
-	if (name.startsWith("xn--") || name.startsWith("sthree-")) return "it starts with a prefix S3 reserves ('xn--', 'sthree-')";
-	if (name.endsWith("-s3alias") || name.endsWith("--ol-s3")) return "it ends with a suffix S3 reserves ('-s3alias', '--ol-s3')";
-}
-/**
-* The good name: `<namespace>-<project>-<stage>-<bucket id>`, lowercased, no
-* dots, shortened to leave room for a clash's suffix.
-*
-* @throws {InvalidBucketName} when nothing usable is left
-*/
-function bucketName(input) {
-	const name = fitParts([
-		input.scope,
-		input.stage,
-		input.id
-	], 56);
-	const problem = bucketNameProblem(name);
-	if (problem) throw new InvalidBucketName(name, problem);
-	return name;
-}
-/** Six random `[a-z0-9]` characters. */
-function randomSuffix(random = node_crypto.randomInt) {
-	let suffix = "";
-	for (let i = 0; i < 6; i++) suffix += SUFFIX_ALPHABET[random(36)];
-	return suffix;
-}
-/** The good name with a clash's suffix. */
-function suffixedBucketName(good, suffix) {
-	return `${good}-${suffix}`;
-}
-/**
-* The IAM user a bucket is reached with on a stage:
-* `gkm-<project>-<stage>-<bucket id>`, at most 64 characters.
-*/
-function iamUserName(input) {
-	return fitParts([
-		"gkm",
-		input.scope,
-		input.stage,
-		input.id
-	], 64);
-}
-/** The path every user gkm creates is under, so it finds its own. */
-const IAM_USER_PATH = "/gkm/";
-/** The inline policy each user is given. */
-const IAM_POLICY_NAME = "gkm-bucket";
 //#endregion
 //#region src/deploy/devServices.ts
 /**
@@ -8134,22 +7529,58 @@ var ExternalServicesNotConfigured = class extends require_errors.GkmError {
 		this.name = "ExternalServicesNotConfigured";
 	}
 };
+/** The kinds a deployed stage takes from its secrets, or a dev service. */
+const SERVICE_KINDS = {
+	email: "email",
+	objects: "objects",
+	"file-server": "file-server"
+};
 /**
-* Every mail and storage construct a manifest declares, with the apps that
-* depend on each — what a target that provisions the whole manifest checks.
+* Every mail and storage construct a manifest declares, each with the apps
+* and workers that read it — a process's environment, a site's build args. A
+* file server's reader reads its bucket too.
+*
+* The one list a deploy's readiness check refuses a stage by, every server
+* target decides its dev services from, and `gkm secrets:add` offers — so
+* none of them can disagree.
 */
-function manifestServiceDeclarations(manifest) {
+function stageServiceDeclarations(input) {
+	const { manifest } = input;
+	const runnables = input.runnables ?? {};
+	const owners = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!SERVICE_KINDS[declaration.kind]) continue;
+		owners.set((0, _geekmidas_manifest.provideKey)(id, "url"), id);
+		if (declaration.kind === "email") owners.set((0, _geekmidas_manifest.provideKey)(id, "from"), id);
+	}
+	const readers = /* @__PURE__ */ new Map();
+	const read = (process, keys) => {
+		for (const key of keys) {
+			const id = owners.get(key);
+			if (!id) continue;
+			const declaration = manifest[id];
+			const of = declaration?.kind === "file-server" ? declaration.of : void 0;
+			for (const owner of of ? [id, of] : [id]) {
+				const set = readers.get(owner) ?? /* @__PURE__ */ new Set();
+				set.add(process);
+				readers.set(owner, set);
+			}
+		}
+	};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const name = require_derive.appKey(id);
+		if (declaration.kind === "rest-api" || declaration.kind === "site" || declaration.kind === "mobile-app") read(name, appEnvKeys(manifest, name, runnables) ?? []);
+		if (declaration.kind === "site") read(name, Object.values((0, _geekmidas_manifest.publicEnvFor)(declaration, manifest)));
+		if (declaration.kind === "worker") read(name, workerEnvKeys(manifest, id, runnables) ?? []);
+	}
 	return Object.entries(manifest).flatMap(([id, declaration]) => {
-		const { kind } = declaration;
-		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
-		const apps = (0, _geekmidas_manifest.dependentsOf)(manifest, id).filter((caller) => {
-			const callerKind = manifest[caller]?.kind;
-			return callerKind === "rest-api" || callerKind === "site";
-		}).map(require_derive.appKey);
+		const kind = SERVICE_KINDS[declaration.kind];
+		if (!kind) return [];
+		const apps = [...readers.get(id) ?? []].sort();
 		return [{
 			id,
 			kind,
-			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...declaration.kind === "file-server" && declaration.of ? { of: declaration.of } : {},
 			...apps.length ? { apps } : {}
 		}];
 	});
@@ -8293,16 +7724,6 @@ function externalServices(input) {
 		mailpit
 	};
 }
-/**
-* `externalServices`, refusing a stage that lacks anything.
-*
-* @throws {ExternalServicesNotConfigured} naming every missing key
-*/
-function assertExternalServices(input) {
-	const services = externalServices(input);
-	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
-	return services;
-}
 /** The dev services a run uses, one entry per service it runs. */
 function devServicesUsed(services) {
 	const used = [];
@@ -8543,7 +7964,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
 	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
-		await require_credentials.run("docker", [
+		await require_run.run("docker", [
 			"build",
 			`--file=${(0, node_path.relative)(buildRoot, app.dockerfile)}`,
 			`--tag=${fullImageName}`,
@@ -8570,7 +7991,7 @@ async function pushDockerImage(imageName, options, cwd) {
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		await require_credentials.run("docker", ["push", fullImageName], { cwd });
+		await require_run.run("docker", ["push", fullImageName], { cwd });
 		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
@@ -8767,96 +8188,6 @@ function printRunInstructions(workspace) {
 	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
-//#region src/secrets/stale.ts
-/**
-* Stored secrets an older gkm generated that now shadow a derived value.
-*
-* Before constructs, initialising a stage wrote an address for each app into
-* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
-* URL with a password of its own, and `http://localhost:<port>` for a site or
-* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
-* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
-* — and a deploy derives them. A value the stage holds is a value set by hand,
-* and set by hand wins: the container is handed `localhost`, where nothing
-* answers, with a password no role has.
-*
-* So a deploy refuses such a stage rather than run it, naming each key and
-* the command that removes it. Nothing is deleted for the user: the value is
-* theirs, and only they can say it is stale. A URL that names a real host — a
-* managed database — is a deliberate choice and still wins.
-*/
-/** The kinds whose URL an older gkm wrote into a stage's secrets. */
-const ADDRESSED = /* @__PURE__ */ new Set([
-	"database",
-	"database-reader",
-	"database-schema",
-	"rest-api",
-	"site"
-]);
-/** Hosts that are this machine — never anything, inside a container. */
-const LOOPBACK = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]",
-	"::1"
-]);
-/**
-* A stage holds a construct's address as a custom secret, pointing at
-* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
-* generated. Set by hand wins over derived, so the app would be handed it.
-*/
-var StaleStageSecrets = class extends require_errors.GkmError {
-	stage;
-	stale;
-	constructor(stage, stale) {
-		const one = stale.length === 1;
-		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
-A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
-		this.stage = stage;
-		this.stale = stale;
-		this.name = "StaleStageSecrets";
-	}
-};
-/** The host a stored value names, if it is a URL. */
-function hostOf(value) {
-	try {
-		return new URL(value).hostname;
-	} catch {
-		return;
-	}
-}
-/**
-* Each stored key that a construct provides an address for, holding an
-* address on this machine.
-*/
-function staleStageSecrets(manifest, supplied) {
-	const stale = [];
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (!ADDRESSED.has(declaration.kind)) continue;
-		const key = (0, _geekmidas_manifest.providedKeyFor)(id, declaration.kind, "url");
-		const value = supplied[key];
-		if (value === void 0) continue;
-		const host = hostOf(value);
-		if (host === void 0 || !LOOPBACK.has(host)) continue;
-		stale.push({
-			key,
-			construct: id,
-			host
-		});
-	}
-	return stale.sort((a, b) => a.key.localeCompare(b.key));
-}
-/**
-* Refuse a stage whose stored secrets would shadow a construct's address with
-* `localhost`.
-*
-* @throws {StaleStageSecrets} naming each key and the command removing it
-*/
-function assertNoStaleSecrets(options) {
-	const stale = staleStageSecrets(options.manifest, options.supplied);
-	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
-}
-//#endregion
 //#region src/target/seeds.ts
 /** A seed of a deployed stage failed; the release stopped before any app. */
 var DeploySeedsFailed = class extends Error {
@@ -8945,6 +8276,12 @@ Object.defineProperty(exports, "DEV_SERVICES", {
 		return DEV_SERVICES;
 	}
 });
+Object.defineProperty(exports, "DeployJournal", {
+	enumerable: true,
+	get: function() {
+		return DeployJournal;
+	}
+});
 Object.defineProperty(exports, "DeploySeedsFailed", {
 	enumerable: true,
 	get: function() {
@@ -8999,24 +8336,6 @@ Object.defineProperty(exports, "FileSecretsStore", {
 		return FileSecretsStore;
 	}
 });
-Object.defineProperty(exports, "HostNotPointingAtServer", {
-	enumerable: true,
-	get: function() {
-		return HostNotPointingAtServer;
-	}
-});
-Object.defineProperty(exports, "IAM_POLICY_NAME", {
-	enumerable: true,
-	get: function() {
-		return IAM_POLICY_NAME;
-	}
-});
-Object.defineProperty(exports, "IAM_USER_PATH", {
-	enumerable: true,
-	get: function() {
-		return IAM_USER_PATH;
-	}
-});
 Object.defineProperty(exports, "LEGACY_LOCAL_LOGIN", {
 	enumerable: true,
 	get: function() {
@@ -9167,18 +8486,6 @@ Object.defineProperty(exports, "assertDevServicesFlag", {
 		return assertDevServicesFlag;
 	}
 });
-Object.defineProperty(exports, "assertExternalServices", {
-	enumerable: true,
-	get: function() {
-		return assertExternalServices;
-	}
-});
-Object.defineProperty(exports, "assertNoStaleSecrets", {
-	enumerable: true,
-	get: function() {
-		return assertNoStaleSecrets;
-	}
-});
 Object.defineProperty(exports, "assertStageProvidersEnabled", {
 	enumerable: true,
 	get: function() {
@@ -9197,12 +8504,6 @@ Object.defineProperty(exports, "bucketClient", {
 		return bucketClient;
 	}
 });
-Object.defineProperty(exports, "bucketName", {
-	enumerable: true,
-	get: function() {
-		return bucketName;
-	}
-});
 Object.defineProperty(exports, "bucketPolicies", {
 	enumerable: true,
 	get: function() {
@@ -9245,6 +8546,12 @@ Object.defineProperty(exports, "createCredentialsPreload", {
 		return createCredentialsPreload;
 	}
 });
+Object.defineProperty(exports, "createDnsProvider", {
+	enumerable: true,
+	get: function() {
+		return createDnsProvider;
+	}
+});
 Object.defineProperty(exports, "createEmptyState", {
 	enumerable: true,
 	get: function() {
@@ -9269,12 +8576,6 @@ Object.defineProperty(exports, "deployIdentity", {
 		return deployIdentity;
 	}
 });
-Object.defineProperty(exports, "deploysWithCompose", {
-	enumerable: true,
-	get: function() {
-		return deploysWithCompose;
-	}
-});
 Object.defineProperty(exports, "derivedContainers", {
 	enumerable: true,
 	get: function() {
@@ -9305,12 +8606,6 @@ Object.defineProperty(exports, "devServicesUsed", {
 		return devServicesUsed;
 	}
 });
-Object.defineProperty(exports, "dnsCredentials", {
-	enumerable: true,
-	get: function() {
-		return dnsCredentials;
-	}
-});
 Object.defineProperty(exports, "dnsRecordResource", {
 	enumerable: true,
 	get: function() {
@@ -9323,12 +8618,6 @@ Object.defineProperty(exports, "dnsResources", {
 		return dnsResources;
 	}
 });
-Object.defineProperty(exports, "dns_exports", {
-	enumerable: true,
-	get: function() {
-		return dns_exports;
-	}
-});
 Object.defineProperty(exports, "dockerCommand", {
 	enumerable: true,
 	get: function() {
@@ -9371,6 +8660,12 @@ Object.defineProperty(exports, "externalServices", {
 		return externalServices;
 	}
 });
+Object.defineProperty(exports, "extractSubdomain", {
+	enumerable: true,
+	get: function() {
+		return extractSubdomain;
+	}
+});
 Object.defineProperty(exports, "fakeKey", {
 	enumerable: true,
 	get: function() {
@@ -9389,6 +8684,12 @@ Object.defineProperty(exports, "findBuildRoot", {
 		return findBuildRoot;
 	}
 });
+Object.defineProperty(exports, "findRootDomain", {
+	enumerable: true,
+	get: function() {
+		return findRootDomain;
+	}
+});
 Object.defineProperty(exports, "forgetState", {
 	enumerable: true,
 	get: function() {
@@ -9419,12 +8720,6 @@ Object.defineProperty(exports, "hostFor", {
 		return hostFor;
 	}
 });
-Object.defineProperty(exports, "iamUserName", {
-	enumerable: true,
-	get: function() {
-		return iamUserName;
-	}
-});
 Object.defineProperty(exports, "imageBuildCredentials", {
 	enumerable: true,
 	get: function() {
@@ -9467,12 +8762,6 @@ Object.defineProperty(exports, "isImageBuild", {
 		return isImageBuild;
 	}
 });
-Object.defineProperty(exports, "isLocalHost", {
-	enumerable: true,
-	get: function() {
-		return isLocalHost;
-	}
-});
 Object.defineProperty(exports, "isMainFrontendApp", {
 	enumerable: true,
 	get: function() {
@@ -9551,12 +8840,6 @@ Object.defineProperty(exports, "logsService", {
 		return logsService;
 	}
 });
-Object.defineProperty(exports, "manifestServiceDeclarations", {
-	enumerable: true,
-	get: function() {
-		return manifestServiceDeclarations;
-	}
-});
 Object.defineProperty(exports, "markerOf", {
 	enumerable: true,
 	get: function() {
@@ -9575,6 +8858,12 @@ Object.defineProperty(exports, "networkEnv", {
 		return networkEnv;
 	}
 });
+Object.defineProperty(exports, "normalizeDnsConfig", {
+	enumerable: true,
+	get: function() {
+		return normalizeDnsConfig;
+	}
+});
 Object.defineProperty(exports, "orchestrateDns", {
 	enumerable: true,
 	get: function() {
@@ -9671,12 +8960,6 @@ Object.defineProperty(exports, "quoteIdentifier", {
 		return quoteIdentifier;
 	}
 });
-Object.defineProperty(exports, "randomSuffix", {
-	enumerable: true,
-	get: function() {
-		return randomSuffix;
-	}
-});
 Object.defineProperty(exports, "readKey", {
 	enumerable: true,
 	get: function() {
@@ -9737,12 +9020,6 @@ Object.defineProperty(exports, "reportPlannedSeeds", {
 		return reportPlannedSeeds;
 	}
 });
-Object.defineProperty(exports, "requiredServerAddress", {
-	enumerable: true,
-	get: function() {
-		return requiredServerAddress;
-	}
-});
 Object.defineProperty(exports, "requiredStageKeys", {
 	enumerable: true,
 	get: function() {
@@ -9779,12 +9056,6 @@ Object.defineProperty(exports, "secretsStoreFor", {
 		return secretsStoreFor;
 	}
 });
-Object.defineProperty(exports, "serverAddressHint", {
-	enumerable: true,
-	get: function() {
-		return serverAddressHint;
-	}
-});
 Object.defineProperty(exports, "setApplicationId", {
 	enumerable: true,
 	get: function() {
@@ -9809,12 +9080,6 @@ Object.defineProperty(exports, "setPostgresBackupId", {
 		return setPostgresBackupId;
 	}
 });
-Object.defineProperty(exports, "stackHosts", {
-	enumerable: true,
-	get: function() {
-		return stackHosts;
-	}
-});
 Object.defineProperty(exports, "stackLogs", {
 	enumerable: true,
 	get: function() {
@@ -9827,22 +9092,16 @@ Object.defineProperty(exports, "stackRedis", {
 		return stackRedis;
 	}
 });
-Object.defineProperty(exports, "stageDns", {
-	enumerable: true,
-	get: function() {
-		return stageDns;
-	}
-});
-Object.defineProperty(exports, "stageDnsDomains", {
+Object.defineProperty(exports, "stageProviderNotes", {
 	enumerable: true,
 	get: function() {
-		return stageDnsDomains;
+		return stageProviderNotes;
 	}
 });
-Object.defineProperty(exports, "stageProviderNotes", {
+Object.defineProperty(exports, "stageServiceDeclarations", {
 	enumerable: true,
 	get: function() {
-		return stageProviderNotes;
+		return stageServiceDeclarations;
 	}
 });
 Object.defineProperty(exports, "storageBackendFor", {
@@ -9869,12 +9128,6 @@ Object.defineProperty(exports, "store_exports", {
 		return store_exports;
 	}
 });
-Object.defineProperty(exports, "suffixedBucketName", {
-	enumerable: true,
-	get: function() {
-		return suffixedBucketName;
-	}
-});
 Object.defineProperty(exports, "suppliedOnly", {
 	enumerable: true,
 	get: function() {
@@ -9887,12 +9140,6 @@ Object.defineProperty(exports, "surfaceClientTraced", {
 		return surfaceClientTraced;
 	}
 });
-Object.defineProperty(exports, "systemLookup", {
-	enumerable: true,
-	get: function() {
-		return systemLookup;
-	}
-});
 Object.defineProperty(exports, "telemetryOf", {
 	enumerable: true,
 	get: function() {
@@ -9990,4 +9237,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-BCg8X36S.cjs.map
+//# sourceMappingURL=seeds-CnXkgKUv.cjs.map