@geekmidas/cli 10.0.0-alpha.87 → 10.0.0-alpha.89

package/dist/index.cjs

@@ -1,24 +1,24 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-tr26-KML.cjs");
+const require_credentials = require("./credentials-BKfIugu2.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CT0JM3Y8.cjs");
+const require_workspace = require("./workspace-CwW3Gkru.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-CsI0A_Ef.cjs");
+const require_seeds = require("./seeds-CN6tB-va.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
 const require_drivers = require("./drivers-LYSdQDmd.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_local = require("./local-Cq8qdgNX.cjs");
-const require_sniffer = require("./sniffer-DJYupBeK.cjs");
-const require_deploy = require("./deploy-CtbZj4zN.cjs");
-const require_compose = require("./compose-xw86kVYi.cjs");
+const require_local = require("./local-BjxDfPvy.cjs");
+const require_sniffer = require("./sniffer-IAQEpsQb.cjs");
+const require_deploy = require("./deploy-DbBGo3a6.cjs");
+const require_compose = require("./compose-BvrhDwJ6.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
-const require_LocalStateStore = require("./LocalStateStore-CLwa2DpK.cjs");
+const require_LocalStateStore = require("./LocalStateStore-CUWh2BWU.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 const require_ready = require("./ready-BpNbORRB.cjs");
 let node_path = require("node:path");
@@ -53,7 +53,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.87";
+var version = "10.0.0-alpha.89";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -136,7 +136,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DJYupBeK.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-IAQEpsQb.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -183,6 +183,10 @@ async function loginCommand(options) {
 		logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
 		logger$8.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
+	if (provider === "godaddy") {
+		await loginGoDaddy(options);
+		return;
+	}
 	if (provider === "hostinger") {
 		logger$8.log("\n🔐 Logging in to Hostinger...\n");
 		let token = providedToken;
@@ -205,15 +209,50 @@ async function loginCommand(options) {
 	}
 }
 /**
+* Store a GoDaddy Personal Access Token. Not validated: the only call that
+* proves a token without a domain is an account call (`GET /v1/domains`),
+* which a token scoped to `domains.dns:update` alone may not make — the first
+* `gkm setup` that writes a record is where a bad token reports itself.
+*/
+async function loginGoDaddy(options) {
+	logger$8.log("\n🔐 Logging in to GoDaddy...\n");
+	let token = options.token;
+	if (!token) {
+		logger$8.log("\nCreate a Personal Access Token in the GoDaddy developer dashboard\n(https://developer.godaddy.com) with only the domains.dns:update scope.\n");
+		token = await prompt("Personal Access Token: ", {
+			hidden: true,
+			instead: LOGIN_INSTEAD
+		});
+	}
+	if (!token) {
+		logger$8.error("Token is required");
+		process.exit(1);
+	}
+	const where = options.home ? { home: options.home } : void 0;
+	await require_credentials.storeGoDaddyToken(token, where);
+	logger$8.log("\n✓ GoDaddy token stored.");
+	logger$8.log(`  Token: ${maskToken(token)}`);
+	logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath(where)}`);
+	logger$8.log("  Not validated here: proving a token without a domain needs an account\n  scope a DNS-only token does not have, so the first gkm setup that\n  writes a record is where a bad token reports itself.");
+	logger$8.log("\nYou can now use it as a DNS provider without setting GODADDY_API_TOKEN.");
+}
+/**
 * Logout from a service
 */
 async function logoutCommand(options) {
 	const { provider = "dokploy" } = options;
 	if (provider === "all") {
-		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from all services");
+		const dokployRemoved = await require_credentials.removeDokployCredentials();
+		const godaddyRemoved = await require_credentials.removeGoDaddyCredentials();
+		if (dokployRemoved || godaddyRemoved) logger$8.log("\n✓ Logged out from all services");
 		else logger$8.log("\nNo stored credentials found");
 		return;
 	}
+	if (provider === "godaddy") {
+		const removed = await require_credentials.removeGoDaddyCredentials();
+		logger$8.log(removed ? "\n✓ Logged out from GoDaddy" : "\nNo GoDaddy credentials found");
+		return;
+	}
 	if (provider === "dokploy") {
 		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from Dokploy");
 		else logger$8.log("\nNo Dokploy credentials found");
@@ -230,6 +269,8 @@ async function whoamiCommand() {
 		logger$8.log(`    Endpoint: ${dokploy.endpoint}`);
 		logger$8.log(`    Token: ${maskToken(dokploy.token)}`);
 	} else logger$8.log("  Dokploy: Not logged in");
+	const godaddy = (await require_credentials.readCredentials()).godaddy;
+	logger$8.log(godaddy ? `  GoDaddy:\n    Token: ${maskToken(godaddy.token)}` : "  GoDaddy: Not logged in");
 	logger$8.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
 }
 /**
@@ -499,6 +540,54 @@ var UnsupportedPlatform = class extends Error {
 	}
 };
 //#endregion
+//#region src/workspace/stageTypes.ts
+/**
+* `.gkm/stages.d.ts`: the declared stages, as types application code can see.
+*
+* Constructs and app code cannot import `gkm.config.ts`, so the stage names it
+* declares were plain strings everywhere else. This writes them into
+* `@geekmidas/constructs`' `Stages` interface, which `LocalStage`,
+* `DeployedStage` and `AnyStage` read — an `ExternalApi` url keyed `prodution`
+* becomes a type error. Without the file those types are `string`.
+*
+* Written by `gkm dev`, `gkm build` and `gkm test --prepare`, beside the
+* generated clients; a project's tsconfig `include`s it.
+*/
+/** Where the declaration is written, relative to the workspace root. */
+const STAGE_TYPES_FILE = ".gkm/stages.d.ts";
+/** A union of string literal types: `'staging' | 'prod'`, or `never`. */
+function union(names) {
+	return names.length ? names.map((name) => `'${name}'`).join(" | ") : "never";
+}
+/** The declaration for a stages block. */
+function stageTypesDeclaration(stages) {
+	return `// Generated by gkm from the \`stages\` in gkm.config.ts — do not edit.
+// \`gkm dev\`, \`gkm build\` and \`gkm test --prepare\` rewrite it.
+export {};
+
+declare module '@geekmidas/constructs' {
+	interface Stages {
+		local: ${union([stages.local])};
+		deployed: ${union(stages.deployed)};
+	}
+}
+`;
+}
+/**
+* Write `.gkm/stages.d.ts` under the workspace root, and return its path — or
+* nothing when there are no stages to write. Left untouched when unchanged, so
+* an editor's watcher does not re-check the project on every start.
+*/
+async function writeStageTypes(root, stages) {
+	if (!stages) return void 0;
+	const path = (0, node_path.join)(root, STAGE_TYPES_FILE);
+	const content = stageTypesDeclaration(stages);
+	if (await (0, node_fs_promises.readFile)(path, "utf8").catch(() => void 0) === content) return path;
+	await (0, node_fs_promises.mkdir)((0, node_path.join)(root, ".gkm"), { recursive: true });
+	await (0, node_fs_promises.writeFile)(path, content);
+	return path;
+}
+//#endregion
 //#region src/dev/credentials.ts
 /**
 * `gkm dev:credentials` — where to sign in to each local service, and as
@@ -1812,8 +1901,10 @@ async function devCommand(options) {
 	if (!appConfig) {
 		logger$5.log("🔎 Reading gkm.config.ts and the constructs");
 		const { workspace: everything } = await require_config.loadWorkspaceConfig();
+		await writeStageTypes(everything.root, everything.stages);
 		return workspaceDevCommand(everything, options);
 	}
+	await writeStageTypes(appConfig.workspace.root, appConfig.workspace.stages);
 	const config = appConfig.gkmConfig;
 	const appRoot = appConfig.appRoot;
 	const secretsRoot = appConfig.workspaceRoot;
@@ -2239,9 +2330,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3144,6 +3235,7 @@ var UnknownCacheBackend = class extends Error {
 };
 async function buildCommand(options) {
 	const loadedConfig = await require_config.loadWorkspaceConfig();
+	await writeStageTypes(loadedConfig.workspace.root, loadedConfig.workspace.stages);
 	if (loadedConfig.type === "workspace") {
 		const cwd = (0, node_path.resolve)(process.cwd());
 		const workspaceRoot = (0, node_path.resolve)(loadedConfig.workspace.root);
@@ -3293,7 +3385,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-1REMhKps.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C4NmpRTD.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3438,7 +3530,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-1REMhKps.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C4NmpRTD.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3524,7 +3616,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-1REMhKps.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C4NmpRTD.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3818,6 +3910,7 @@ async function composeCommand(options, deps = {}) {
 		...options.dryRun ? { dryRun: true } : {},
 		...options.push ? { buildOnly: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
+		...options.skipDnsCheck ? { skipDnsCheck: true } : {},
 		logger: {
 			info: (message) => console.log(message),
 			warn: (message) => console.warn(message),
@@ -5225,25 +5318,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.87",
-	"@geekmidas/auth": "~10.0.0-alpha.87",
-	"@geekmidas/cache": "~10.0.0-alpha.87",
-	"@geekmidas/client": "~10.0.0-alpha.87",
-	"@geekmidas/cloud": "~10.0.0-alpha.87",
-	"@geekmidas/constructs": "~10.0.0-alpha.87",
-	"@geekmidas/db": "~10.0.0-alpha.87",
-	"@geekmidas/emailkit": "~10.0.0-alpha.87",
-	"@geekmidas/envkit": "~10.0.0-alpha.87",
-	"@geekmidas/errors": "~10.0.0-alpha.87",
-	"@geekmidas/events": "~10.0.0-alpha.87",
-	"@geekmidas/logger": "~10.0.0-alpha.87",
-	"@geekmidas/manifest": "~10.0.0-alpha.87",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.87",
-	"@geekmidas/schema": "~10.0.0-alpha.87",
-	"@geekmidas/services": "~10.0.0-alpha.87",
-	"@geekmidas/storage": "~10.0.0-alpha.87",
-	"@geekmidas/telescope": "~10.0.0-alpha.87",
-	"@geekmidas/testkit": "~10.0.0-alpha.87",
+	"@geekmidas/audit": "~10.0.0-alpha.89",
+	"@geekmidas/auth": "~10.0.0-alpha.89",
+	"@geekmidas/cache": "~10.0.0-alpha.89",
+	"@geekmidas/client": "~10.0.0-alpha.89",
+	"@geekmidas/cloud": "~10.0.0-alpha.89",
+	"@geekmidas/constructs": "~10.0.0-alpha.89",
+	"@geekmidas/db": "~10.0.0-alpha.89",
+	"@geekmidas/emailkit": "~10.0.0-alpha.89",
+	"@geekmidas/envkit": "~10.0.0-alpha.89",
+	"@geekmidas/errors": "~10.0.0-alpha.89",
+	"@geekmidas/events": "~10.0.0-alpha.89",
+	"@geekmidas/logger": "~10.0.0-alpha.89",
+	"@geekmidas/manifest": "~10.0.0-alpha.89",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.89",
+	"@geekmidas/schema": "~10.0.0-alpha.89",
+	"@geekmidas/services": "~10.0.0-alpha.89",
+	"@geekmidas/storage": "~10.0.0-alpha.89",
+	"@geekmidas/telescope": "~10.0.0-alpha.89",
+	"@geekmidas/testkit": "~10.0.0-alpha.89",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5294,7 +5387,7 @@ function generateAuthAppFiles(options) {
 				[`@${options.name}/*`]: ["../../packages/*/src"]
 			}
 		},
-		include: ["src/**/*.ts"],
+		include: ["src/**/*.ts", "../../.gkm/stages.d.ts"],
 		exclude: ["node_modules", "dist"]
 	};
 	return [
@@ -5405,7 +5498,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 	gkmConfig += `
 });
 `;
-	const tsConfig = options.monorepo ? workspaceApiTsConfig(options.name) : {
+	const tsConfig = options.monorepo ? workspaceApiTsConfig(options.name, ".gkm/stages.d.ts") : {
 		compilerOptions: {
 			target: "ES2022",
 			module: "NodeNext",
@@ -5420,7 +5513,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 			allowImportingTsExtensions: true,
 			paths: { "~/*": ["./src/*"] }
 		},
-		include: ["src/**/*.ts"],
+		include: ["src/**/*.ts", ".gkm/stages.d.ts"],
 		exclude: ["node_modules", "dist"]
 	};
 	if (options.monorepo) {
@@ -5535,7 +5628,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 * the root constructs, so in the other `@<name>/constructs/api.ts` fell through
 * to the `packages/` mapping and nothing could load the surface.
 */
-function workspaceApiTsConfig(name) {
+function workspaceApiTsConfig(name, stageTypes) {
 	return {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
@@ -5547,12 +5640,12 @@ function workspaceApiTsConfig(name) {
 				[`@${name}/*`]: ["../../packages/*/src"]
 			}
 		},
-		include: ["src/**/*.ts"],
+		include: ["src/**/*.ts", stageTypes],
 		exclude: ["node_modules", "dist"]
 	};
 }
 function generateSingleAppConfigFiles(options, _template, _helpers) {
-	const tsConfig = workspaceApiTsConfig(options.name);
+	const tsConfig = workspaceApiTsConfig(options.name, "../../.gkm/stages.d.ts");
 	const files = [{
 		path: "tsconfig.json",
 		content: `${JSON.stringify(tsConfig, null, 2)}\n`
@@ -5644,7 +5737,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "8bf34e377e5def9821eacaea3971d6daf6c91748", version = cliVersion()) {
+function stagesActionUses(commit = "e1be097c3e5909843479a2dcd97f06e952f5b1aa", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7404,6 +7497,7 @@ ${isSst ? "\n# SST\n.sst/\n" : ""}`;
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true
 		},
+		include: ["**/*", ".gkm/stages.d.ts"],
 		exclude: [
 			"node_modules",
 			"dist",
@@ -10925,6 +11019,135 @@ function maskUrl(url) {
 	}
 }
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return require_compose.serverAddress(stage, secrets?.custom);
+	return require_compose.requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: require_seeds.constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await require_seeds.secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await Promise.resolve().then(() => require("./compose-BvrhDwJ6.cjs")).then((n) => n.secrets_exports);
+	const { composeStack } = await Promise.resolve().then(() => require("./compose-BvrhDwJ6.cjs")).then((n) => n.stack_exports);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: require_seeds.deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	});
+	return require_compose.stackHosts(stack);
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const store = await require_seeds.secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	});
+	const server = require_compose.serverAddress(stage, (await store.read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${require_compose.serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = require_compose.planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		return {
+			mode: "records",
+			hosts,
+			changes: await require_compose.applyStackDns(plan, {
+				...options.dryRun ? { dryRun: true } : {},
+				log,
+				credentials: {
+					env: options.env ?? process.env,
+					...options.home ? { home: options.home } : {},
+					log
+				},
+				...options.providerFor ? { providerFor: options.providerFor } : {}
+			})
+		};
+	} catch (error) {
+		if (error instanceof require_credentials.MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
@@ -10958,6 +11181,7 @@ async function setupCommand(options = {}) {
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
+	if (!local) assertStageServer(workspace, stage, await (await require_seeds.secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
 	if (!local && options.dryRun) {
 		await provisionDeployed(workspace, stage, options);
 		return;
@@ -10991,11 +11215,16 @@ async function provisionDeployed(workspace, stage, options) {
 		...options.retireOldKeys ? { retireOldKeys: true } : {},
 		log: (line) => logger$1.log(line)
 	})).filter((r) => r.mode === "provider");
-	if (configured.length === 0) {
-		logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${require_seeds.provisionCommand(stage)} create it.`);
-		return;
-	}
-	const changes = configured.reduce((n, r) => n + r.actions.length, 0);
+	if (configured.length === 0) logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${require_seeds.provisionCommand(stage)} create it.`);
+	const dns = await provisionStageDns({
+		workspace,
+		stage,
+		...options.dryRun ? { dryRun: true } : {},
+		...options.profile ? { profile: options.profile } : {},
+		log: (line) => logger$1.log(line)
+	});
+	const changes = configured.reduce((n, r) => n + r.actions.length, 0) + dns.changes.filter((c) => c.action !== "unchanged" && c.action !== "manual").length;
+	if (configured.length === 0 && dns.mode === "none") return;
 	logger$1.log(options.dryRun ? `\n${changes === 0 ? "✅ Nothing to change" : `📋 ${changes} change${changes === 1 ? "" : "s"} planned`}` : `\n✅ '${stage}' provisioned${changes === 0 ? " — already up to date" : ` (${changes} change${changes === 1 ? "" : "s"})`}`);
 }
 /**
@@ -11266,6 +11495,7 @@ async function testCommand(options = {}) {
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
 	await require_seeds.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+	if (workspace) await writeStageTypes(workspace.root, workspace.stages);
 	const manifestPath = workspace ? await require_ready.writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path))],
@@ -11349,7 +11579,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-D1It5r_h.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -11793,7 +12023,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11807,7 +12037,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11821,7 +12051,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11870,7 +12100,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Deployed stage: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11929,7 +12159,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-5MZAXybv.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-C9qX4Juc.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11940,7 +12170,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CDn7BH5O.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-BrN_9_CM.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11951,7 +12181,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CDn7BH5O.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-BrN_9_CM.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11994,7 +12224,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CsI0A_Ef.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CN6tB-va.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12003,7 +12233,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CsI0A_Ef.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CN6tB-va.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12021,15 +12251,15 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-B16qgYTn.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-DPF7ZF8M.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-BL8ZHsLQ.cjs"));
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-C85Dut8K.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12040,14 +12270,15 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		...options.json ? { json: true } : {},
 		...options.dryRun ? { dryRun: true } : {},
 		...options.atomic ? { atomic: true } : {},
-		...options.allowDevServices ? { allowDevServices: true } : {}
+		...options.allowDevServices ? { allowDevServices: true } : {},
+		...options.skipDnsCheck ? { skipDnsCheck: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-DFMiBWf0.cjs")).then((n) => n.rollback_exports);
-		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-COv23heb.cjs"));
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-65VVIdBM.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-DuapRxh6.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12082,7 +12313,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DFhuJQlp.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-Bf7pz6AV.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12093,7 +12324,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-Brn3vcdy.cjs"));
+		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-CUn6gvXL.cjs"));
 		await stagesCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12127,13 +12358,17 @@ program.command("deploy:list").description("List Dokploy resources (projects, re
 		process.exit(1);
 	}
 });
-program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
+program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger, godaddy)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const provider = options.service ?? options.provider;
-		if (!["dokploy", "hostinger"].includes(provider)) {
-			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger`);
+		if (![
+			"dokploy",
+			"hostinger",
+			"godaddy"
+		].includes(provider)) {
+			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger, godaddy`);
 			process.exit(1);
 		}
 		await loginCommand({
@@ -12146,7 +12381,7 @@ program.command("login").description("Authenticate with a deployment or DNS prov
 		process.exit(1);
 	}
 });
-program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
+program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, godaddy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12235,6 +12470,7 @@ try {
 program.parse();
 //#endregion
 exports.canPrompt = canPrompt;
+exports.deploysWithCompose = deploysWithCompose;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.prompt = prompt;