@geekmidas/cli 10.0.0-alpha.94 → 10.0.0-alpha.96

package/dist/{seeds-CTxTZa-R.mjs → seeds-CbJSne1A.mjs}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { s as run$1, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
+import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, ot as cnameTarget, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DWK1PTXP.mjs";
+import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as SERVER_IPV6_KEY, ft as UnknownSecretsStoreProvider, j as TEST_STAGE, st as SERVER_IPV4_KEY, ut as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-CqFUjObk.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
-import { c as runtimeOf } from "./resolve-Dyd1S2wn.mjs";
+import { c as runtimeOf } from "./resolve-CUne0qOm.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -16,7 +16,7 @@ import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
 import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
-import { createServer, isIPv4, isIPv6 } from "node:net";
+import { createServer } from "node:net";
 import { execFile, spawn } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
 import { config } from "dotenv";
@@ -6667,7 +6667,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-Cjh_2Ml6.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-BNpS9aRJ.mjs");
 		return new HostingerProvider(options.hostinger);
 	}
 	if (provider === "route53") {
@@ -6680,7 +6680,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-BRZUWD8z.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-BsUKjGcg.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7235,644 +7235,121 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 //#endregion
-//#region src/compose/dns.ts
-/**
-* A compose stage's DNS: the records its public hosts need, and the check that
-* they resolve to its server before a certificate is asked for.
-*
-* - **The server** (`serverAddress`): the stage's own secrets hold its public
-*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
-*   Reserved for gkm: never handed to an app.
-* - **The plan** (`planStackDns`, pure): every public host the stack serves —
-*   its apex, each app, each file server, the public log UI — pointed at the
-*   server. An A record per host (and an AAAA with an IPv6 address), or, where
-*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
-*   record for the target and a CNAME to it for every other host but the
-*   apex, which DNS forbids a CNAME at.
-* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
-*   a record set at a time. A record with the right value is left alone; one
-*   with another value is replaced and the change printed. A `manual` domain
-*   is printed and nothing else. A dry run reads, prints and writes nothing.
-* - **The check** (`checkStackDns`): each host resolved with the system
-*   resolver. One that is not the server stops the deploy with
-*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
-*   for a certificate it cannot get — and use up the rate limit trying.
-* - **The step** (`stageDns`): all three, as every deploy runs them — the plan applied through each provider,
-*   what was written read back from the provider, and only the hosts no
-*   provider wrote resolved publicly. A brand-new name is never looked up
-*   before its record exists, so no resolver caches it as missing.
-*/
-/** The line that says how to set the server's address. */
-function serverAddressHint(stage) {
-	return `gkm secrets:set ${SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
-}
-/** A server address in the stage's secrets that is not an address. */
-var ServerAddressInvalid = class extends GkmError {
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
 	stage;
-	key;
-	value;
-	constructor(stage, key, value) {
-		const ipv4 = key === SERVER_IPV4_KEY;
-		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
-		this.stage = stage;
-		this.key = key;
-		this.value = value;
-		this.name = "ServerAddressInvalid";
-	}
-};
-/**
-* A compose stage that serves real domains with no server address: its hosts
-* cannot be pointed or checked, and a certificate would be asked for blind.
-*/
-var ServerAddressMissing = class extends GkmError {
-	stage;
-	domain;
-	constructor(stage, domain) {
-		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${SERVER_IPV6_KEY} for an IPv6 address).`);
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
 		this.stage = stage;
-		this.domain = domain;
-		this.name = "ServerAddressMissing";
-	}
-};
-/**
-* The server's address from the stage's secrets, checked — `undefined` when
-* `GKM_SERVER_IPV4` is not set.
-*
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function serverAddress(stage, custom) {
-	const ipv4 = custom?.[SERVER_IPV4_KEY]?.trim();
-	const ipv6 = custom?.[SERVER_IPV6_KEY]?.trim();
-	if (ipv6 && !isIPv6(ipv6)) throw new ServerAddressInvalid(stage, SERVER_IPV6_KEY, ipv6);
-	if (!ipv4) return void 0;
-	if (!isIPv4(ipv4)) throw new ServerAddressInvalid(stage, SERVER_IPV4_KEY, ipv4);
-	return {
-		ipv4,
-		...ipv6 ? { ipv6 } : {}
-	};
-}
-/**
-* A name that resolves to this machine by definition — `localhost` and every
-* `*.localhost` — and is in nobody's DNS.
-*/
-function isLocalHost(host) {
-	const name = host.toLowerCase().replace(/\.$/, "");
-	return name === "localhost" || name.endsWith(".localhost");
-}
-/**
-* The server's address, required where the stage serves real domains — not
-* `*.localhost` ones, which point at this machine already.
-*
-* @throws {ServerAddressMissing} when the stage has a domain and no address
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function requiredServerAddress(stage, domain, custom) {
-	const server = serverAddress(stage, custom);
-	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
-	return server;
-}
-const MANAGED = [
-	"A",
-	"AAAA",
-	"CNAME"
-];
-/** Every public host the stack serves, once each, sorted. */
-function stackHosts(stack) {
-	return [...new Set(stack.routes.map((route) => route.host))].sort();
-}
-/** The TTL a domain's records are written with. */
-function recordTtl(config) {
-	const ttl = "ttl" in config ? config.ttl : void 0;
-	if (ttl) return ttl;
-	return config.provider === "godaddy" ? 600 : 300;
-}
-function providerName(config) {
-	return typeof config.provider === "string" ? config.provider : "custom";
-}
-/**
-* A wildcard host: gkm writes one record per public host, so a stage on
-* another server — or a name someone else points elsewhere — is never caught
-* by a record it did not ask for.
-*/
-var DnsWildcardRefused = class extends GkmError {
-	stage;
-	host;
-	constructor(stage, host) {
-		super(`'${stage}' would point ${host} at its server, and gkm never writes a wildcard record: each public host gets its own. Give the app a subdomain of its own instead.`);
-		this.stage = stage;
-		this.host = host;
-		this.name = "DnsWildcardRefused";
-	}
-};
-/** The records a stage's hosts need — pure. */
-function planStackDns(input) {
-	const { stage, server } = input;
-	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
-	const records = /* @__PURE__ */ new Map();
-	const uncovered = [];
-	const add = (host, domain, type, value) => {
-		const name = extractSubdomain(host, domain);
-		records.set(`${domain} ${name} ${type}`, {
-			host,
-			domain,
-			name,
-			type,
-			value,
-			ttl: recordTtl(dns[domain])
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	static async open(store, stage, initial, adopt = (stored) => stored) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
 		});
-	};
-	const pointAt = (host, domain) => {
-		add(host, domain, "A", server.ipv4);
-		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
-	};
-	for (const raw of input.hosts) {
-		const host = raw.toLowerCase();
-		if (host.includes("*")) throw new DnsWildcardRefused(stage, host);
-		const domain = findRootDomain(host, dns);
-		if (!domain) {
-			uncovered.push(host);
-			continue;
-		}
-		const target = cnameTarget(dns[domain].records, stage);
-		if (target) pointAt(target, domain);
-		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
-		else pointAt(host, domain);
-	}
-	const domains = /* @__PURE__ */ new Map();
-	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
-		const config = dns[record.domain];
-		const plan = domains.get(record.domain) ?? {
-			domain: record.domain,
-			provider: providerName(config),
-			config,
-			records: []
-		};
-		plan.records.push(record);
-		domains.set(record.domain, plan);
 	}
-	return {
-		stage,
-		server,
-		domains: [...domains.values()],
-		uncovered: uncovered.sort()
-	};
-}
-/** Records a provider accepted and then did not read back with their value. */
-var DnsRecordsNotConfirmed = class extends GkmError {
-	stage;
-	domain;
-	provider;
-	records;
-	constructor(stage, domain, provider, records) {
-		const lines = records.map((r) => `  - ${r.host} ${r.type}: ${r.found.length > 0 ? r.found.join(", ") : "nothing"}, expected ${r.expected}`);
-		super(`${provider} accepted '${stage}''s records for ${domain}, and reading them back does not show them:\n${lines.join("\n")}\nDeploy again; if it persists, check the records in the provider's console — another tool may be writing the same names.`);
-		this.stage = stage;
-		this.domain = domain;
-		this.provider = provider;
-		this.records = records;
-		this.name = "DnsRecordsNotConfirmed";
-	}
-};
-/** `api.example.com  A  203.0.113.10  (TTL 600)` */
-function describe(record) {
-	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
-}
-function printManual(plan, log, why) {
-	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
-	for (const record of plan.records) log(`     ${describe(record)}`);
-	return plan.records.map((r) => ({
-		domain: r.domain,
-		name: r.name,
-		type: r.type,
-		action: "manual",
-		value: r.value,
-		ttl: r.ttl
-	}));
-}
-/** The existing records of every planned name, for the types gkm manages. */
-async function existingRecords(provider, plan) {
-	const names = [...new Set(plan.records.map((r) => r.name))];
-	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
-		name,
-		type
-	})));
-	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
-	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
-}
-const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
-/**
-* What each domain's records need, compared with what is there: creates,
-* updates, and the deletes a change of mode needs — a name moving from an A
-* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
-*/
-function diffDomainDns(plan, existing) {
-	const changes = [];
-	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
-	const planned = /* @__PURE__ */ new Map();
-	for (const record of plan.records) {
-		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
-		types.add(record.type);
-		planned.set(record.name, types);
-	}
-	for (const [name, types] of planned) {
-		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
-		for (const type of conflicting) {
-			const found = find(name, type);
-			if (!found || found.values.length === 0) continue;
-			changes.push({
-				domain: plan.domain,
-				name,
-				type,
-				action: "delete",
-				previous: found.values.join(", ")
-			});
-		}
-	}
-	for (const record of plan.records) {
-		const found = find(record.name, record.type);
-		const base = {
-			domain: plan.domain,
-			name: record.name,
-			type: record.type,
-			value: record.value,
-			ttl: record.ttl
-		};
-		if (!found || found.values.length === 0) changes.push({
-			...base,
-			action: "create"
-		});
-		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
-			...base,
-			action: "unchanged"
-		});
-		else changes.push({
-			...base,
-			action: "update",
-			previous: found.values.join(", ")
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
 		});
 	}
-	return changes;
-}
-/** A host's full name from a domain and a relative name. */
-function fullName(domain, name) {
-	return name === "@" ? domain : `${name}.${domain}`;
-}
-function printChange(change, dryRun, log) {
-	const host = fullName(change.domain, change.name).padEnd(32);
-	const type = change.type.padEnd(5);
-	const would = dryRun ? "would " : "";
-	switch (change.action) {
-		case "unchanged":
-			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
-			break;
-		case "create":
-			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
-			break;
-		case "update":
-			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
-			break;
-		case "write":
-			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
-			break;
-		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
-	}
-}
-/**
-* Each domain's records, through its provider — and, with `confirm`, what was
-* written read back from it. A record already holding its value is neither
-* written nor read again.
-*
-* @throws {DnsRecordsNotConfirmed} when a written record does not read back
-*/
-async function settleStackDns(plan, options = {}) {
-	const dryRun = options.dryRun === true;
-	const log = options.log ?? ((line) => console.log(line));
-	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
-		config,
-		...options.credentials ? { godaddy: options.credentials } : {},
-		...options.hostinger ? { hostinger: options.hostinger } : {}
-	}));
-	const changes = [];
-	const confirmed = /* @__PURE__ */ new Set();
-	const unconfirmed = /* @__PURE__ */ new Set();
-	const hostsOf = (domain) => new Set(domain.records.map((r) => r.host));
-	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
-	for (const domain of plan.domains) {
-		if (domain.provider === "manual") {
-			changes.push(...printManual(domain, log, "manual"));
-			for (const host of hostsOf(domain)) unconfirmed.add(host);
-			continue;
-		}
-		const provider = await providerFor(domain.config);
-		if (!provider) {
-			changes.push(...printManual(domain, log, "manual"));
-			for (const host of hostsOf(domain)) unconfirmed.add(host);
-			continue;
-		}
-		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
-		let existing;
-		let diff;
-		let unreadable = false;
-		try {
-			existing = await existingRecords(provider, domain);
-			diff = diffDomainDns(domain, existing);
-		} catch (error) {
-			if (!(error instanceof DnsRecordsUnreadable)) throw error;
-			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
-			unreadable = true;
-			existing = [];
-			diff = domain.records.map((r) => ({
-				domain: r.domain,
-				name: r.name,
-				type: r.type,
-				action: "write",
-				value: r.value,
-				ttl: r.ttl
-			}));
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
 		}
-		for (const change of diff) printChange(change, dryRun, log);
-		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
-			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
-			const planned = domain.records.find((r) => r.name === name && r.type === "A");
-			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
 		}
-		changes.push(...diff);
-		const written = new Set(diff.filter((c) => c.action !== "unchanged").map((c) => fullName(c.domain, c.name)));
-		for (const host of hostsOf(domain)) if (unreadable) {
-			if (!dryRun) unconfirmed.add(host);
-		} else if (!written.has(host)) confirmed.add(host);
-		if (dryRun) continue;
-		const deletes = diff.filter((c) => c.action === "delete");
-		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
-			name: c.name,
-			type: c.type
-		})));
-		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
-		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
-			name: c.name,
-			type: c.type,
-			value: c.value,
-			ttl: c.ttl
-		})));
-		if (!options.confirm || unreadable || written.size === 0) continue;
-		const rewritten = {
-			...domain,
-			records: domain.records.filter((r) => written.has(r.host))
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
 		};
-		const after = await existingRecords(provider, rewritten);
-		const missing = [];
-		for (const record of rewritten.records) {
-			const values = after.find((r) => r.name === record.name && r.type === record.type)?.values ?? [];
-			if (values.length !== 1 || !same(values[0], record.value)) missing.push({
-				host: record.host,
-				type: record.type,
-				expected: record.value,
-				found: values
-			});
-		}
-		if (missing.length > 0) throw new DnsRecordsNotConfirmed(plan.stage, domain.domain, provider.name, missing);
-		for (const host of written) confirmed.add(host);
-		log(`   ✓ ${written.size} host${written.size === 1 ? "" : "s"} read back from ${provider.name}`);
-	}
-	for (const host of plan.uncovered) unconfirmed.add(host);
-	return {
-		changes,
-		confirmed: [...confirmed].sort(),
-		unconfirmed: [...unconfirmed].filter((h) => !confirmed.has(h)).sort()
-	};
-}
-/** The system resolver: what the server's own clients would be told. */
-const systemLookup = async (host) => {
-	return (await lookup(host, { all: true })).map((a) => a.address);
-};
-/** Hosts that do not resolve to the stage's server. */
-var HostNotPointingAtServer = class extends GkmError {
-	stage;
-	hosts;
-	expected;
-	fix;
-	constructor(stage, hosts, expected, fix) {
-		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
-		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
-		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns.`);
-		this.stage = stage;
-		this.hosts = hosts;
-		this.expected = expected;
-		this.fix = fix;
-		this.name = "HostNotPointingAtServer";
 	}
-};
-/**
-* Every host resolved: each must resolve to the server's IPv4 address and to
-* nothing but the server's addresses.
-*
-* @throws {HostNotPointingAtServer} naming every host that does not
-*/
-async function checkStackDns(input) {
-	const lookup = input.lookup ?? systemLookup;
-	const { server } = input;
-	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
-	const bad = [];
-	const ok = [];
-	for (const host of input.hosts) {
-		let resolved;
-		try {
-			resolved = [...new Set(await lookup(host))];
-		} catch (error) {
-			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
-			bad.push({
-				host,
-				resolved: [],
-				error: code
-			});
-			continue;
-		}
-		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
-		else bad.push({
-			host,
-			resolved
-		});
-	}
-	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
-		ipv4: server.ipv4,
-		...server.ipv6 ? { ipv6: server.ipv6 } : {}
-	}, dnsFix(input, bad));
-	return ok;
-}
-/** How to fix it: the deploy, or the records to create by hand. */
-function dnsFix(input, bad) {
-	const hosts = bad.map((h) => h.host);
-	let plan;
-	try {
-		plan = planStackDns({
-			stage: input.stage,
-			hosts,
-			server: input.server,
-			dns: input.dns
-		});
-	} catch {
-		plan = {
-			stage: input.stage,
-			server: input.server,
-			domains: [],
-			uncovered: hosts
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
 		};
 	}
-	const automatic = plan.domains.filter((d) => d.provider !== "manual");
-	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
-	const lines = [];
-	if (automatic.length > 0) lines.push(`Fix: gkm deploy --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} through their provider (--dry-run shows them first).`);
-	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
-	return lines.join("\n");
-}
-/** The environment variable each token-authenticated provider reads. */
-const DNS_TOKEN_KEYS = {
-	godaddy: "GODADDY_API_TOKEN",
-	hostinger: "HOSTINGER_API_TOKEN"
-};
-/**
-* A domain whose records the deploy writes, and no token to write them with.
-* Raised before anything is built, started or written.
-*/
-var DnsCredentialMissing = class extends GkmError {
-	stage;
-	domain;
-	provider;
-	key;
-	constructor(stage, domain, provider, key) {
-		super(`'${stage}''s hosts are under ${domain}, whose DNS is ${provider}'s, and the deploy writes their records — but ${key} is not set. In CI, add ${key} as a secret on the '${stage}' GitHub environment and pass it to the step that writes the records: env: { ${key}: \${{ secrets.${key} }} }. On this machine, export ${key} or run gkm login --provider ${provider}. With a CDN or proxy in front of the server, pass --skip-dns.`);
-		this.stage = stage;
-		this.domain = domain;
-		this.provider = provider;
-		this.key = key;
-		this.name = "DnsCredentialMissing";
-	}
 };
-/**
-* The `dns` domain a stage's own domain (`domains.<stage>`) is under — where
-* its hosts' records go — or none.
-*/
-function stageDnsDomains(stage, domains, dns) {
-	const own = domains?.[stage];
-	if (!own || !dns || isLocalHost(own)) return [];
-	const normalized = normalizeDnsConfig(dns);
-	const root = findRootDomain(own.toLowerCase(), normalized);
-	return root ? [{
-		domain: root,
-		config: normalized[root]
-	}] : [];
-}
-/**
-* Each token the domains' providers need, from `credentials` — `manual`,
-* Route53 (the AWS SDK's own chain) and a provider object need none.
-*
-* @throws {DnsCredentialMissing} naming the first domain with no token
-*/
-async function dnsCredentials(stage, domains, credentials) {
-	const found = {};
-	for (const { domain, config } of domains) {
-		const provider = config.provider;
-		if (provider !== "godaddy" && provider !== "hostinger") continue;
-		if (found[provider]) continue;
-		const token = await credentials.get({ kind: provider });
-		if (!token?.token) throw new DnsCredentialMissing(stage, domain, provider, DNS_TOKEN_KEYS[provider]);
-		found[provider] = token;
-	}
-	return found;
-}
-/**
-* A stage's DNS, as every deploy runs it: the
-* stage's own hosts planned, written through each domain's provider where
-* they differ, and read back from it. Only A, AAAA and CNAME records of
-* those names are touched; nothing is a wildcard, and no other name is read,
-* written or deleted. What no provider confirms — a `manual` domain, a host
-* under no domain in `dns`, a key that cannot read — is resolved publicly.
-* A dry run prints the plan and writes nothing.
-*
-* @throws {DnsCredentialMissing} before anything is read or written
-* @throws {DnsRecordsNotConfirmed} when a written record does not read back
-* @throws {HostNotPointingAtServer} when a resolved host is not the server
-*/
-async function stageDns(input) {
-	const { stage, server } = input;
-	const log = input.log ?? ((line) => console.log(line));
-	const plan = planStackDns({
-		stage,
-		hosts: input.hosts,
-		server,
-		dns: input.dns
-	});
-	const tokens = await dnsCredentials(stage, plan.domains.map(({ domain, config }) => ({
-		domain,
-		config
-	})), input.credentials);
-	const applied = !input.dns ? {
-		changes: [],
-		confirmed: [],
-		unconfirmed: [...plan.uncovered]
-	} : await settleStackDns(plan, {
-		...input.dryRun ? { dryRun: true } : { confirm: true },
-		log,
-		credentials: {
-			...input.godaddy ?? {},
-			...tokens.godaddy ? { credential: tokens.godaddy } : {},
-			log
-		},
-		...tokens.hostinger ? { hostinger: tokens.hostinger } : {},
-		...input.providerFor ? { providerFor: input.providerFor } : {}
-	});
-	let resolved = [];
-	if (applied.unconfirmed.length > 0) resolved = await checkStackDns({
-		stage,
-		hosts: applied.unconfirmed,
-		server,
-		dns: input.dns,
-		...input.lookup ? { lookup: input.lookup } : {}
-	});
-	return {
-		plan,
-		changes: applied.changes,
-		confirmed: applied.confirmed,
-		resolved
-	};
-}
-//#endregion
-//#region src/providers/dns.ts
-var dns_exports = /* @__PURE__ */ __exportAll({
-	composeStageHosts: () => composeStageHosts,
-	deploysWithCompose: () => deploysWithCompose
-});
-/** Whether the workspace deploys through the compose target. */
-function deploysWithCompose(workspace) {
-	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
-}
-/**
-* The hosts a compose stage serves: its stack composed as a deploy would —
-* with the secrets it would generate made up in memory, never written — and
-* every route's host read off it.
-*/
-async function composeStageHosts(options) {
-	const { workspace, stage, manifest } = options;
-	const { deployedStackSecrets } = await import("./secrets-CwLauUB_.mjs").then((n) => n.n);
-	const { composeStack } = await import("./stack-NrdH5ngX.mjs").then((n) => n.c);
-	const { secrets } = deployedStackSecrets(workspace, stage, options.stored, manifest);
-	return stackHosts(composeStack({
-		workspace,
-		manifest,
-		runnables: options.runnables,
-		background: options.background,
-		stage,
-		identity: deployIdentity(workspace, stage),
-		images: {
-			mode: "pull",
-			tag: "dns",
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
-		},
-		secrets,
-		buildOnly: true,
-		allowDevServices: true
-	}));
-}
 //#endregion
 //#region src/providers/types.ts
 /** The manifest kinds a stage can name a provider for. */
@@ -7938,88 +7415,6 @@ function assertStageProvidersEnabled(workspace, manifest, stage) {
 		if (stageProvider(workspace, kind, stage).mode === "none") throw new StageProviderDisabled(kind, stage, ids);
 	}
 }
-const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
-/** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends GkmError {
-	bucket;
-	reason;
-	constructor(bucket, reason) {
-		super(`'${bucket}' is not a valid S3 bucket name: ${reason}. Rename the construct or set deploy.namespace in gkm.config.ts to something that leaves room for it.`);
-		this.bucket = bucket;
-		this.reason = reason;
-		this.name = "InvalidBucketName";
-	}
-};
-/** Lowercase `[a-z0-9-]`, runs of anything else one `-`, no edge dashes. */
-function part(value) {
-	return kebabCase(value).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/**
-* `parts` joined by `-`, shortened to `max` characters by trimming the longest
-* part one character at a time — so a long construct id gives way before a
-* short stage name does, and every part keeps its start.
-*/
-function fitParts(parts, max) {
-	const kept = parts.map(part).filter(Boolean);
-	const length = () => kept.reduce((sum, p) => sum + p.length, 0) + kept.length - 1;
-	while (length() > max) {
-		let longest = 0;
-		for (let i = 1; i < kept.length; i++) if (kept[i].length > kept[longest].length) longest = i;
-		if (kept[longest].length <= 1) break;
-		kept[longest] = kept[longest].slice(0, -1).replace(/-+$/, "");
-	}
-	return kept.join("-");
-}
-/** Why `name` is not a valid bucket name, or undefined when it is. */
-function bucketNameProblem(name) {
-	if (name.length < 3 || name.length > 63) return `it is ${name.length} characters, and S3 takes 3 to 63`;
-	if (!/^[a-z0-9-]+$/.test(name)) return "it may hold only lowercase letters, digits and -";
-	if (!/^[a-z0-9].*[a-z0-9]$/.test(name)) return "it must start and end with a letter or a digit";
-	if (name.startsWith("xn--") || name.startsWith("sthree-")) return "it starts with a prefix S3 reserves ('xn--', 'sthree-')";
-	if (name.endsWith("-s3alias") || name.endsWith("--ol-s3")) return "it ends with a suffix S3 reserves ('-s3alias', '--ol-s3')";
-}
-/**
-* The good name: `<namespace>-<project>-<stage>-<bucket id>`, lowercased, no
-* dots, shortened to leave room for a clash's suffix.
-*
-* @throws {InvalidBucketName} when nothing usable is left
-*/
-function bucketName(input) {
-	const name = fitParts([
-		input.scope,
-		input.stage,
-		input.id
-	], 56);
-	const problem = bucketNameProblem(name);
-	if (problem) throw new InvalidBucketName(name, problem);
-	return name;
-}
-/** Six random `[a-z0-9]` characters. */
-function randomSuffix(random = randomInt) {
-	let suffix = "";
-	for (let i = 0; i < 6; i++) suffix += SUFFIX_ALPHABET[random(36)];
-	return suffix;
-}
-/** The good name with a clash's suffix. */
-function suffixedBucketName(good, suffix) {
-	return `${good}-${suffix}`;
-}
-/**
-* The IAM user a bucket is reached with on a stage:
-* `gkm-<project>-<stage>-<bucket id>`, at most 64 characters.
-*/
-function iamUserName(input) {
-	return fitParts([
-		"gkm",
-		input.scope,
-		input.stage,
-		input.id
-	], 64);
-}
-/** The path every user gkm creates is under, so it finds its own. */
-const IAM_USER_PATH = "/gkm/";
-/** The inline policy each user is given. */
-const IAM_POLICY_NAME = "gkm-bucket";
 //#endregion
 //#region src/deploy/devServices.ts
 /**
@@ -8120,22 +7515,58 @@ var ExternalServicesNotConfigured = class extends GkmError {
 		this.name = "ExternalServicesNotConfigured";
 	}
 };
+/** The kinds a deployed stage takes from its secrets, or a dev service. */
+const SERVICE_KINDS = {
+	email: "email",
+	objects: "objects",
+	"file-server": "file-server"
+};
 /**
-* Every mail and storage construct a manifest declares, with the apps that
-* depend on each — what a target that provisions the whole manifest checks.
+* Every mail and storage construct a manifest declares, each with the apps
+* and workers that read it — a process's environment, a site's build args. A
+* file server's reader reads its bucket too.
+*
+* The one list a deploy's readiness check refuses a stage by, every server
+* target decides its dev services from, and `gkm secrets:add` offers — so
+* none of them can disagree.
 */
-function manifestServiceDeclarations(manifest) {
+function stageServiceDeclarations(input) {
+	const { manifest } = input;
+	const runnables = input.runnables ?? {};
+	const owners = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!SERVICE_KINDS[declaration.kind]) continue;
+		owners.set(provideKey(id, "url"), id);
+		if (declaration.kind === "email") owners.set(provideKey(id, "from"), id);
+	}
+	const readers = /* @__PURE__ */ new Map();
+	const read = (process, keys) => {
+		for (const key of keys) {
+			const id = owners.get(key);
+			if (!id) continue;
+			const declaration = manifest[id];
+			const of = declaration?.kind === "file-server" ? declaration.of : void 0;
+			for (const owner of of ? [id, of] : [id]) {
+				const set = readers.get(owner) ?? /* @__PURE__ */ new Set();
+				set.add(process);
+				readers.set(owner, set);
+			}
+		}
+	};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const name = appKey(id);
+		if (declaration.kind === "rest-api" || declaration.kind === "site" || declaration.kind === "mobile-app") read(name, appEnvKeys(manifest, name, runnables) ?? []);
+		if (declaration.kind === "site") read(name, Object.values(publicEnvFor(declaration, manifest)));
+		if (declaration.kind === "worker") read(name, workerEnvKeys(manifest, id, runnables) ?? []);
+	}
 	return Object.entries(manifest).flatMap(([id, declaration]) => {
-		const { kind } = declaration;
-		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
-		const apps = dependentsOf(manifest, id).filter((caller) => {
-			const callerKind = manifest[caller]?.kind;
-			return callerKind === "rest-api" || callerKind === "site";
-		}).map(appKey);
+		const kind = SERVICE_KINDS[declaration.kind];
+		if (!kind) return [];
+		const apps = [...readers.get(id) ?? []].sort();
 		return [{
 			id,
 			kind,
-			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...declaration.kind === "file-server" && declaration.of ? { of: declaration.of } : {},
 			...apps.length ? { apps } : {}
 		}];
 	});
@@ -8279,16 +7710,6 @@ function externalServices(input) {
 		mailpit
 	};
 }
-/**
-* `externalServices`, refusing a stage that lacks anything.
-*
-* @throws {ExternalServicesNotConfigured} naming every missing key
-*/
-function assertExternalServices(input) {
-	const services = externalServices(input);
-	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
-	return services;
-}
 /** The dev services a run uses, one entry per service it runs. */
 function devServicesUsed(services) {
 	const used = [];
@@ -8753,96 +8174,6 @@ function printRunInstructions(workspace) {
 	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
-//#region src/secrets/stale.ts
-/**
-* Stored secrets an older gkm generated that now shadow a derived value.
-*
-* Before constructs, initialising a stage wrote an address for each app into
-* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
-* URL with a password of its own, and `http://localhost:<port>` for a site or
-* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
-* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
-* — and a deploy derives them. A value the stage holds is a value set by hand,
-* and set by hand wins: the container is handed `localhost`, where nothing
-* answers, with a password no role has.
-*
-* So a deploy refuses such a stage rather than run it, naming each key and
-* the command that removes it. Nothing is deleted for the user: the value is
-* theirs, and only they can say it is stale. A URL that names a real host — a
-* managed database — is a deliberate choice and still wins.
-*/
-/** The kinds whose URL an older gkm wrote into a stage's secrets. */
-const ADDRESSED = /* @__PURE__ */ new Set([
-	"database",
-	"database-reader",
-	"database-schema",
-	"rest-api",
-	"site"
-]);
-/** Hosts that are this machine — never anything, inside a container. */
-const LOOPBACK = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]",
-	"::1"
-]);
-/**
-* A stage holds a construct's address as a custom secret, pointing at
-* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
-* generated. Set by hand wins over derived, so the app would be handed it.
-*/
-var StaleStageSecrets = class extends GkmError {
-	stage;
-	stale;
-	constructor(stage, stale) {
-		const one = stale.length === 1;
-		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
-A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
-		this.stage = stage;
-		this.stale = stale;
-		this.name = "StaleStageSecrets";
-	}
-};
-/** The host a stored value names, if it is a URL. */
-function hostOf(value) {
-	try {
-		return new URL(value).hostname;
-	} catch {
-		return;
-	}
-}
-/**
-* Each stored key that a construct provides an address for, holding an
-* address on this machine.
-*/
-function staleStageSecrets(manifest, supplied) {
-	const stale = [];
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (!ADDRESSED.has(declaration.kind)) continue;
-		const key = providedKeyFor(id, declaration.kind, "url");
-		const value = supplied[key];
-		if (value === void 0) continue;
-		const host = hostOf(value);
-		if (host === void 0 || !LOOPBACK.has(host)) continue;
-		stale.push({
-			key,
-			construct: id,
-			host
-		});
-	}
-	return stale.sort((a, b) => a.key.localeCompare(b.key));
-}
-/**
-* Refuse a stage whose stored secrets would shadow a construct's address with
-* `localhost`.
-*
-* @throws {StaleStageSecrets} naming each key and the command removing it
-*/
-function assertNoStaleSecrets(options) {
-	const stale = staleStageSecrets(options.manifest, options.supplied);
-	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
-}
-//#endregion
 //#region src/target/seeds.ts
 /** A seed of a deployed stage failed; the release stopped before any app. */
 var DeploySeedsFailed = class extends Error {
@@ -8901,6 +8232,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { systemLookup as $, imageRef as $n, workerEnvKeys as $t, requiredStageKeys as A, portKeys as An, withGeneratedSecrets as At, provisionCommand as B, prepareEntryCredentials as Bn, applyPolicies as Bt, STORAGE_KEY_PAIR as C, scopeTelemetryEnv as Cn, derivedContainers as Ct, externalServices as D, DEFAULT_IMAGES as Dn, loadLocalCredentials as Dt, devServicesUsed as E, usesTelemetry as En, LOCAL_RABBITMQ_USER as Et, iamUserName as F, findAvailablePort as Fn, stackRedis as Ft, HostNotPointingAtServer as G, FileSecretsStore as Gn, quoteIdentifier as Gt, PROVIDER_KINDS as H, secretsStoreFor as Hn, bucketPolicies as Ht, randomSuffix as I, isPortAvailable as In, withRedisPassword as It, requiredServerAddress as J, projectKey as Jn, bucketClient as Jt, dnsCredentials as K, getKeyPath as Kn, LEGACY_LOCAL_LOGIN as Kt, suffixedBucketName as L, loadEnvFiles as Ln, LOCAL_CA_PATH as Lt, IAM_POLICY_NAME as M, primaryPortKey as Mn, STACK_CACHE as Mt, IAM_USER_PATH as N, createCredentialsPreload as Nn, redisService as Nt, manifestServiceDeclarations as O, describeServices as On, postgresSuperuser as Ot, bucketName as P, createEntryWrapper as Pn, runsRedis as Pt, stageDnsDomains as Q, imageName as Qn, networkEnv as Qt, StageProviderDisabled as R, loadPortState as Rn, forgetState as Rt, ExternalServicesNotConfigured as S, isTelemetryKey as Sn, constructGlobs as St, assertExternalServices as T, telemetryOf as Tn, workspace_exports as Tt, deploysWithCompose as U, storeFromConfig as Un, postgresDatabaseNames as Ut, stageProviderNotes as V, isRemoteStore as Vn, applyPostgres as Vt, dns_exports as W, store_exports as Wn, postgresStatements as Wt, stackHosts as X, applicationName as Xn, appEnvKeys as Xt, serverAddressHint as Y, readKey as Yn, pgClient as Yt, stageDns as Z, deployIdentity as Zn, dockerfileOf as Zt, describeActor as _, TELEMETRY_CONTAINER as _n, resolveHost as _r, workerEntryDir as _t, DockerBuildFailed as a, WORKER_PORT as an, maskPassword as ar, getBackupState as at, DEV_SERVICES as b, hostFor as bn, FAKE_ENV as bt, dockerCommand as c, imageBuildCredentials as cn, withCustomSecret as cr, recordRollback as ct, workerDockerfileOf as d, eventsBackendFor as dn, logsAccess as dr, setGeneratedSecret as dt, envFor as en, isOwnedBy as er, orchestrateDns as et, validateImageRef as f, providerOf as fn, logsService as fr, setPostgresBackupId as ft, currentActor as g, EMULATOR_ACCESS_KEY_ID as gn, isMainFrontendApp as gr, workerBundleName as gt, recordDnsChanges as h, composeFor as hn, NoDomainForStage as hr, WorkerGenerator as ht, assertNoStaleSecrets as i, TURBO_VERSION as in, initStageSecrets as ir, createEmptyState as it, suppliedOnly as j, portsOf as jn, REDIS_SERVICE as jt, reportDevServices as k, fakeKey as kn, readLocalCredentials as kt, ensureDockerignore as l, isImageBuild as ln, LOCAL_LOGS_EMAIL as lr, setApplicationId as lt, dnsResources as m, CLUSTER_DATABASE as mn, withLogsPassword as mr, workerUnits as mt, reportDatabaseRuns as n, composeBuildPaths as nn, ownershipMarker as nr, asDokployState as nt, DockerPushFailed as o, detectPackageManager as on, storage_exports as or, getGeneratedSecret as ot, dnsRecordResource as p, storageBackendFor as pn, stackLogs as pr, DnsRecordsUnreadable as pt, isLocalHost as q, keystoreProject as qn, ensurePostgresLogin as qt, reportPlannedSeeds as r, imageLayout as rn, projectName as rr, createComposeState as rt, appDockerfile as s, findBuildRoot as sn, toEmbeddableSecrets as sr, recordRelease as st, DeploySeedsFailed as t, localRolePassword as tn, markerOf as tr, verifyDnsRecords as tt, workerDockerfile as u, cacheBackendFor as un, LOGS_SERVICE as ur, setBackupState as ut, isCi as v, planFor as vn, QueueGenerator as vt, assertDevServicesFlag as w, surfaceClientTraced as wn, reconcileWorkspace as wt, DevServicesNeedServerTarget as x, appTelemetry as xn, backendsOf as xt, AllowDevServicesTakesNoValue as y, resourceName as yn, CronGenerator as yt, assertStageProvidersEnabled as z, loadSecretsForApp as zn, applyBuckets as zt };
+export { createDnsProvider as $, stackLogs as $n, storageBackendFor as $t, StageProviderDisabled as A, store_exports as An, postgresStatements as At, verifyDnsRecords as B, isOwnedBy as Bn, envFor as Bt, assertDevServicesFlag as C, loadEnvFiles as Cn, LOCAL_CA_PATH as Ct, requiredStageKeys as D, isRemoteStore as Dn, applyPostgres as Dt, reportDevServices as E, prepareEntryCredentials as En, applyPolicies as Et, DeployJournal as F, readKey as Fn, pgClient as Ft, getGeneratedSecret as G, maskPassword as Gn, WORKER_PORT as Gt, createComposeState as H, ownershipMarker as Hn, composeBuildPaths as Ht, extractSubdomain as I, applicationName as In, appEnvKeys as It, setApplicationId as J, withCustomSecret as Jn, imageBuildCredentials as Jt, recordRelease as K, storage_exports as Kn, detectPackageManager as Kt, findRootDomain as L, deployIdentity as Ln, dockerfileOf as Lt, provisionCommand as M, getKeyPath as Mn, LEGACY_LOCAL_LOGIN as Mt, stageProviderNotes as N, keystoreProject as Nn, ensurePostgresLogin as Nt, stageServiceDeclarations as O, secretsStoreFor as On, bucketPolicies as Ot, PROVIDER_KINDS as P, projectKey as Pn, bucketClient as Pt, DnsRecordsUnreadable as Q, logsService as Qn, providerOf as Qt, normalizeDnsConfig as R, imageName as Rn, networkEnv as Rt, STORAGE_KEY_PAIR as S, isPortAvailable as Sn, withRedisPassword as St, externalServices as T, loadSecretsForApp as Tn, applyBuckets as Tt, createEmptyState as U, projectName as Un, imageLayout as Ut, asDokployState as V, markerOf as Vn, localRolePassword as Vt, getBackupState as W, initStageSecrets as Wn, TURBO_VERSION as Wt, setGeneratedSecret as X, LOGS_SERVICE as Xn, cacheBackendFor as Xt, setBackupState as Y, LOCAL_LOGS_EMAIL as Yn, isImageBuild as Yt, setPostgresBackupId as Z, logsAccess as Zn, eventsBackendFor as Zt, isCi as _, portsOf as _n, REDIS_SERVICE as _t, DockerPushFailed as a, resourceName as an, CronGenerator as at, DevServicesNeedServerTarget as b, createEntryWrapper as bn, runsRedis as bt, ensureDockerignore as c, isTelemetryKey as cn, constructGlobs as ct, validateImageRef as d, telemetryOf as dn, workspace_exports as dt, CLUSTER_DATABASE as en, withLogsPassword as er, workerUnits as et, dnsRecordResource as f, usesTelemetry as fn, LOCAL_RABBITMQ_USER as ft, describeActor as g, portKeys as gn, withGeneratedSecrets as gt, currentActor as h, fakeKey as hn, readLocalCredentials as ht, DockerBuildFailed as i, planFor as in, QueueGenerator as it, assertStageProvidersEnabled as j, FileSecretsStore as jn, quoteIdentifier as jt, suppliedOnly as k, storeFromConfig as kn, postgresDatabaseNames as kt, workerDockerfile as l, scopeTelemetryEnv as ln, derivedContainers as lt, recordDnsChanges as m, describeServices as mn, postgresSuperuser as mt, reportDatabaseRuns as n, EMULATOR_ACCESS_KEY_ID as nn, isMainFrontendApp as nr, workerBundleName as nt, appDockerfile as o, hostFor as on, FAKE_ENV as ot, dnsResources as p, DEFAULT_IMAGES as pn, loadLocalCredentials as pt, recordRollback as q, toEmbeddableSecrets as qn, findBuildRoot as qt, reportPlannedSeeds as r, TELEMETRY_CONTAINER as rn, resolveHost as rr, workerEntryDir as rt, dockerCommand as s, appTelemetry as sn, backendsOf as st, DeploySeedsFailed as t, composeFor as tn, NoDomainForStage as tr, WorkerGenerator as tt, workerDockerfileOf as u, surfaceClientTraced as un, reconcileWorkspace as ut, AllowDevServicesTakesNoValue as v, primaryPortKey as vn, STACK_CACHE as vt, devServicesUsed as w, loadPortState as wn, forgetState as wt, ExternalServicesNotConfigured as x, findAvailablePort as xn, stackRedis as xt, DEV_SERVICES as y, createCredentialsPreload as yn, redisService as yt, orchestrateDns as z, imageRef as zn, workerEnvKeys as zt };
 
-//# sourceMappingURL=seeds-CTxTZa-R.mjs.map
+//# sourceMappingURL=seeds-CbJSne1A.mjs.map