@geekmidas/cli 10.0.0-alpha.87 → 10.0.0-alpha.89

package/dist/index.mjs

@@ -1,23 +1,23 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { d as getDokployRegistryId, f as getDokployToken, g as storeHostingerToken, h as storeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as removeDokployCredentials, o as DEFAULT_TIMEOUT_MS, u as getDokployCredentials } from "./credentials-BgJ5mS_d.mjs";
+import { _ as storeDokployCredentials, d as getDokployRegistryId, f as getDokployToken, g as removeGoDaddyCredentials, h as removeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as readCredentials, o as DEFAULT_TIMEOUT_MS, t as MissingCredential, u as getDokployCredentials, v as storeGoDaddyToken, y as storeHostingerToken } from "./credentials-CnVqoXMb.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { I as stageSampleRate, M as deployedProblems, N as stageProblems, O as InvalidStages, c as getAppBuildOrder, k as TEST_STAGE, l as getAppGkmConfig, r as allConstructGlobs } from "./workspace-D2CYLMCW.mjs";
+import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-CJ0lKFq-.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { Cn as loadEnvFiles, Ct as LOCAL_CA_PATH, D as dockerCommand, En as prepareEntryCredentials, Ft as pgClient, Gn as maskPassword, Jn as withCustomSecret, Jt as imageBuildCredentials, K as assertDevServicesFlag, Ln as deployIdentity, Mn as getKeyPath, On as secretsStoreFor, Pn as projectKey, Qt as providerOf, S as provisionCommand, Sn as isPortAvailable, Tn as loadSecretsForApp, Xt as cacheBackendFor, Yn as LOCAL_LOGS_EMAIL, Yt as isImageBuild, Zt as eventsBackendFor, _n as portsOf, a as provisionStage, at as CronGenerator, bn as createEntryWrapper, ct as constructGlobs, dn as telemetryOf, en as CLUSTER_DATABASE, et as workerUnits, hn as fakeKey, ht as readLocalCredentials, it as QueueGenerator, jn as FileSecretsStore, jt as quoteIdentifier, kt as postgresDatabaseNames, ln as scopeTelemetryEnv, lt as derivedContainers, mn as describeServices, nt as workerBundleName, ot as FAKE_ENV, qn as toEmbeddableSecrets, rn as TELEMETRY_CONTAINER, rt as workerEntryDir, sn as appTelemetry, st as backendsOf$1, tt as WorkerGenerator, un as surfaceClientTraced, ut as reconcileWorkspace, vn as primaryPortKey, wn as loadPortState, wt as forgetState, xn as findAvailablePort, yn as createCredentialsPreload, z as createStateStore } from "./seeds-BYdrtZsC.mjs";
+import { $n as LOCAL_LOGS_EMAIL, $t as isImageBuild, An as prepareEntryCredentials, Cn as createCredentialsPreload, Dn as loadEnvFiles, Dt as LOCAL_CA_PATH, En as isPortAvailable, Fn as FileSecretsStore, Ft as quoteIdentifier, In as getKeyPath, Mn as secretsStoreFor, Nt as postgresDatabaseNames, On as loadPortState, Ot as forgetState, Qn as withCustomSecret, Qt as imageBuildCredentials, Rn as projectKey, Sn as primaryPortKey, Tn as findAvailablePort, U as createStateStore, Vn as deployIdentity, X as assertDevServicesFlag, Yn as maskPassword, Zn as toEmbeddableSecrets, a as provisionStage, at as WorkerGenerator, ct as QueueGenerator, dn as appTelemetry, dt as backendsOf$1, en as cacheBackendFor, ft as constructGlobs, h as dockerCommand, hn as telemetryOf, in as CLUSTER_DATABASE, it as workerUnits, kn as loadSecretsForApp, lt as CronGenerator, mn as surfaceClientTraced, mt as reconcileWorkspace, nn as providerOf, ot as workerBundleName, pn as scopeTelemetryEnv, pt as derivedContainers, sn as TELEMETRY_CONTAINER, st as workerEntryDir, tn as eventsBackendFor, u as provisionCommand, ut as FAKE_ENV, vn as describeServices, wn as createEntryWrapper, xn as portsOf, yn as fakeKey, yt as readLocalCredentials, zt as pgClient } from "./seeds-perzdN81.mjs";
 import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
 import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-DTZzxeIl.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as LocalSandbox } from "./local-Ciq-bTPr.mjs";
-import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-B0EU73bj.mjs";
-import { t as deploy$1 } from "./deploy-BTfmXd3g.mjs";
-import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-DbJhRQlh.mjs";
+import { t as LocalSandbox } from "./local-IuoIF3CT.mjs";
+import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BTtX3NUM.mjs";
+import { t as deploy$1 } from "./deploy-BaERRh0Q.mjs";
+import { _ as planStackDns, a as stackOverrideFile, b as serverAddressHint, d as pinnedRef, f as edgeDir, g as applyStackDns, h as dockerCompose, i as ComposePushNeedsBuild, m as EDGE_PROJECT, o as composeProject, p as removeEdgeRoutes, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as parseDigests, v as requiredServerAddress, x as stackHosts, y as serverAddress } from "./compose-Dn0oAgQ0.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-Q4vXg2ua.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-C_hYDv6I.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-b6vm0-W-.mjs";
 import { createRequire } from "node:module";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.87";
+var version = "10.0.0-alpha.89";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -130,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-B0EU73bj.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-BTtX3NUM.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -177,6 +177,10 @@ async function loginCommand(options) {
 		logger$8.log(`  Credentials stored in: ${getCredentialsPath()}`);
 		logger$8.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
+	if (provider === "godaddy") {
+		await loginGoDaddy(options);
+		return;
+	}
 	if (provider === "hostinger") {
 		logger$8.log("\n🔐 Logging in to Hostinger...\n");
 		let token = providedToken;
@@ -199,15 +203,50 @@ async function loginCommand(options) {
 	}
 }
 /**
+* Store a GoDaddy Personal Access Token. Not validated: the only call that
+* proves a token without a domain is an account call (`GET /v1/domains`),
+* which a token scoped to `domains.dns:update` alone may not make — the first
+* `gkm setup` that writes a record is where a bad token reports itself.
+*/
+async function loginGoDaddy(options) {
+	logger$8.log("\n🔐 Logging in to GoDaddy...\n");
+	let token = options.token;
+	if (!token) {
+		logger$8.log("\nCreate a Personal Access Token in the GoDaddy developer dashboard\n(https://developer.godaddy.com) with only the domains.dns:update scope.\n");
+		token = await prompt("Personal Access Token: ", {
+			hidden: true,
+			instead: LOGIN_INSTEAD
+		});
+	}
+	if (!token) {
+		logger$8.error("Token is required");
+		process.exit(1);
+	}
+	const where = options.home ? { home: options.home } : void 0;
+	await storeGoDaddyToken(token, where);
+	logger$8.log("\n✓ GoDaddy token stored.");
+	logger$8.log(`  Token: ${maskToken(token)}`);
+	logger$8.log(`  Credentials stored in: ${getCredentialsPath(where)}`);
+	logger$8.log("  Not validated here: proving a token without a domain needs an account\n  scope a DNS-only token does not have, so the first gkm setup that\n  writes a record is where a bad token reports itself.");
+	logger$8.log("\nYou can now use it as a DNS provider without setting GODADDY_API_TOKEN.");
+}
+/**
 * Logout from a service
 */
 async function logoutCommand(options) {
 	const { provider = "dokploy" } = options;
 	if (provider === "all") {
-		if (await removeDokployCredentials()) logger$8.log("\n✓ Logged out from all services");
+		const dokployRemoved = await removeDokployCredentials();
+		const godaddyRemoved = await removeGoDaddyCredentials();
+		if (dokployRemoved || godaddyRemoved) logger$8.log("\n✓ Logged out from all services");
 		else logger$8.log("\nNo stored credentials found");
 		return;
 	}
+	if (provider === "godaddy") {
+		const removed = await removeGoDaddyCredentials();
+		logger$8.log(removed ? "\n✓ Logged out from GoDaddy" : "\nNo GoDaddy credentials found");
+		return;
+	}
 	if (provider === "dokploy") {
 		if (await removeDokployCredentials()) logger$8.log("\n✓ Logged out from Dokploy");
 		else logger$8.log("\nNo Dokploy credentials found");
@@ -224,6 +263,8 @@ async function whoamiCommand() {
 		logger$8.log(`    Endpoint: ${dokploy.endpoint}`);
 		logger$8.log(`    Token: ${maskToken(dokploy.token)}`);
 	} else logger$8.log("  Dokploy: Not logged in");
+	const godaddy = (await readCredentials()).godaddy;
+	logger$8.log(godaddy ? `  GoDaddy:\n    Token: ${maskToken(godaddy.token)}` : "  GoDaddy: Not logged in");
 	logger$8.log(`\n  Credentials file: ${getCredentialsPath()}`);
 }
 /**
@@ -493,6 +534,54 @@ var UnsupportedPlatform = class extends Error {
 	}
 };
 //#endregion
+//#region src/workspace/stageTypes.ts
+/**
+* `.gkm/stages.d.ts`: the declared stages, as types application code can see.
+*
+* Constructs and app code cannot import `gkm.config.ts`, so the stage names it
+* declares were plain strings everywhere else. This writes them into
+* `@geekmidas/constructs`' `Stages` interface, which `LocalStage`,
+* `DeployedStage` and `AnyStage` read — an `ExternalApi` url keyed `prodution`
+* becomes a type error. Without the file those types are `string`.
+*
+* Written by `gkm dev`, `gkm build` and `gkm test --prepare`, beside the
+* generated clients; a project's tsconfig `include`s it.
+*/
+/** Where the declaration is written, relative to the workspace root. */
+const STAGE_TYPES_FILE = ".gkm/stages.d.ts";
+/** A union of string literal types: `'staging' | 'prod'`, or `never`. */
+function union(names) {
+	return names.length ? names.map((name) => `'${name}'`).join(" | ") : "never";
+}
+/** The declaration for a stages block. */
+function stageTypesDeclaration(stages) {
+	return `// Generated by gkm from the \`stages\` in gkm.config.ts — do not edit.
+// \`gkm dev\`, \`gkm build\` and \`gkm test --prepare\` rewrite it.
+export {};
+
+declare module '@geekmidas/constructs' {
+	interface Stages {
+		local: ${union([stages.local])};
+		deployed: ${union(stages.deployed)};
+	}
+}
+`;
+}
+/**
+* Write `.gkm/stages.d.ts` under the workspace root, and return its path — or
+* nothing when there are no stages to write. Left untouched when unchanged, so
+* an editor's watcher does not re-check the project on every start.
+*/
+async function writeStageTypes(root, stages) {
+	if (!stages) return void 0;
+	const path = join(root, STAGE_TYPES_FILE);
+	const content = stageTypesDeclaration(stages);
+	if (await readFile(path, "utf8").catch(() => void 0) === content) return path;
+	await mkdir(join(root, ".gkm"), { recursive: true });
+	await writeFile(path, content);
+	return path;
+}
+//#endregion
 //#region src/dev/credentials.ts
 /**
 * `gkm dev:credentials` — where to sign in to each local service, and as
@@ -1806,8 +1895,10 @@ async function devCommand(options) {
 	if (!appConfig) {
 		logger$5.log("🔎 Reading gkm.config.ts and the constructs");
 		const { workspace: everything } = await loadWorkspaceConfig();
+		await writeStageTypes(everything.root, everything.stages);
 		return workspaceDevCommand(everything, options);
 	}
+	await writeStageTypes(appConfig.workspace.root, appConfig.workspace.stages);
 	const config = appConfig.gkmConfig;
 	const appRoot = appConfig.appRoot;
 	const secretsRoot = appConfig.workspaceRoot;
@@ -2233,9 +2324,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-ggkPVJRC.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CKLJ73OO.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-ggkPVJRC.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CKLJ73OO.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3138,6 +3229,7 @@ var UnknownCacheBackend = class extends Error {
 };
 async function buildCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
+	await writeStageTypes(loadedConfig.workspace.root, loadedConfig.workspace.stages);
 	if (loadedConfig.type === "workspace") {
 		const cwd = resolve(process.cwd());
 		const workspaceRoot = resolve(loadedConfig.workspace.root);
@@ -3287,7 +3379,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-BMo-JP5s.mjs");
+			const { bundleServer } = await import("./bundler-C_fCgcVO.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3432,7 +3524,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-BMo-JP5s.mjs");
+		const { bundleServer } = await import("./bundler-C_fCgcVO.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3518,7 +3610,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-BMo-JP5s.mjs");
+			const { bundleServer } = await import("./bundler-C_fCgcVO.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3812,6 +3904,7 @@ async function composeCommand(options, deps = {}) {
 		...options.dryRun ? { dryRun: true } : {},
 		...options.push ? { buildOnly: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
+		...options.skipDnsCheck ? { skipDnsCheck: true } : {},
 		logger: {
 			info: (message) => console.log(message),
 			warn: (message) => console.warn(message),
@@ -5219,25 +5312,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.87",
-	"@geekmidas/auth": "~10.0.0-alpha.87",
-	"@geekmidas/cache": "~10.0.0-alpha.87",
-	"@geekmidas/client": "~10.0.0-alpha.87",
-	"@geekmidas/cloud": "~10.0.0-alpha.87",
-	"@geekmidas/constructs": "~10.0.0-alpha.87",
-	"@geekmidas/db": "~10.0.0-alpha.87",
-	"@geekmidas/emailkit": "~10.0.0-alpha.87",
-	"@geekmidas/envkit": "~10.0.0-alpha.87",
-	"@geekmidas/errors": "~10.0.0-alpha.87",
-	"@geekmidas/events": "~10.0.0-alpha.87",
-	"@geekmidas/logger": "~10.0.0-alpha.87",
-	"@geekmidas/manifest": "~10.0.0-alpha.87",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.87",
-	"@geekmidas/schema": "~10.0.0-alpha.87",
-	"@geekmidas/services": "~10.0.0-alpha.87",
-	"@geekmidas/storage": "~10.0.0-alpha.87",
-	"@geekmidas/telescope": "~10.0.0-alpha.87",
-	"@geekmidas/testkit": "~10.0.0-alpha.87",
+	"@geekmidas/audit": "~10.0.0-alpha.89",
+	"@geekmidas/auth": "~10.0.0-alpha.89",
+	"@geekmidas/cache": "~10.0.0-alpha.89",
+	"@geekmidas/client": "~10.0.0-alpha.89",
+	"@geekmidas/cloud": "~10.0.0-alpha.89",
+	"@geekmidas/constructs": "~10.0.0-alpha.89",
+	"@geekmidas/db": "~10.0.0-alpha.89",
+	"@geekmidas/emailkit": "~10.0.0-alpha.89",
+	"@geekmidas/envkit": "~10.0.0-alpha.89",
+	"@geekmidas/errors": "~10.0.0-alpha.89",
+	"@geekmidas/events": "~10.0.0-alpha.89",
+	"@geekmidas/logger": "~10.0.0-alpha.89",
+	"@geekmidas/manifest": "~10.0.0-alpha.89",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.89",
+	"@geekmidas/schema": "~10.0.0-alpha.89",
+	"@geekmidas/services": "~10.0.0-alpha.89",
+	"@geekmidas/storage": "~10.0.0-alpha.89",
+	"@geekmidas/telescope": "~10.0.0-alpha.89",
+	"@geekmidas/testkit": "~10.0.0-alpha.89",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5288,7 +5381,7 @@ function generateAuthAppFiles(options) {
 				[`@${options.name}/*`]: ["../../packages/*/src"]
 			}
 		},
-		include: ["src/**/*.ts"],
+		include: ["src/**/*.ts", "../../.gkm/stages.d.ts"],
 		exclude: ["node_modules", "dist"]
 	};
 	return [
@@ -5399,7 +5492,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 	gkmConfig += `
 });
 `;
-	const tsConfig = options.monorepo ? workspaceApiTsConfig(options.name) : {
+	const tsConfig = options.monorepo ? workspaceApiTsConfig(options.name, ".gkm/stages.d.ts") : {
 		compilerOptions: {
 			target: "ES2022",
 			module: "NodeNext",
@@ -5414,7 +5507,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 			allowImportingTsExtensions: true,
 			paths: { "~/*": ["./src/*"] }
 		},
-		include: ["src/**/*.ts"],
+		include: ["src/**/*.ts", ".gkm/stages.d.ts"],
 		exclude: ["node_modules", "dist"]
 	};
 	if (options.monorepo) {
@@ -5529,7 +5622,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 * the root constructs, so in the other `@<name>/constructs/api.ts` fell through
 * to the `packages/` mapping and nothing could load the surface.
 */
-function workspaceApiTsConfig(name) {
+function workspaceApiTsConfig(name, stageTypes) {
 	return {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
@@ -5541,12 +5634,12 @@ function workspaceApiTsConfig(name) {
 				[`@${name}/*`]: ["../../packages/*/src"]
 			}
 		},
-		include: ["src/**/*.ts"],
+		include: ["src/**/*.ts", stageTypes],
 		exclude: ["node_modules", "dist"]
 	};
 }
 function generateSingleAppConfigFiles(options, _template, _helpers) {
-	const tsConfig = workspaceApiTsConfig(options.name);
+	const tsConfig = workspaceApiTsConfig(options.name, "../../.gkm/stages.d.ts");
 	const files = [{
 		path: "tsconfig.json",
 		content: `${JSON.stringify(tsConfig, null, 2)}\n`
@@ -5638,7 +5731,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "8bf34e377e5def9821eacaea3971d6daf6c91748", version = cliVersion()) {
+function stagesActionUses(commit = "e1be097c3e5909843479a2dcd97f06e952f5b1aa", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7398,6 +7491,7 @@ ${isSst ? "\n# SST\n.sst/\n" : ""}`;
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true
 		},
+		include: ["**/*", ".gkm/stages.d.ts"],
 		exclude: [
 			"node_modules",
 			"dist",
@@ -10919,6 +11013,135 @@ function maskUrl(url) {
 	}
 }
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return serverAddress(stage, secrets?.custom);
+	return requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await import("./compose-Dn0oAgQ0.mjs").then((n) => n.l);
+	const { composeStack } = await import("./compose-Dn0oAgQ0.mjs").then((n) => n.c);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	});
+	return stackHosts(stack);
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const store = await secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	});
+	const server = serverAddress(stage, (await store.read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		return {
+			mode: "records",
+			hosts,
+			changes: await applyStackDns(plan, {
+				...options.dryRun ? { dryRun: true } : {},
+				log,
+				credentials: {
+					env: options.env ?? process.env,
+					...options.home ? { home: options.home } : {},
+					log
+				},
+				...options.providerFor ? { providerFor: options.providerFor } : {}
+			})
+		};
+	} catch (error) {
+		if (error instanceof MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ __exportAll({
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
@@ -10952,6 +11175,7 @@ async function setupCommand(options = {}) {
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
+	if (!local) assertStageServer(workspace, stage, await (await secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
 	if (!local && options.dryRun) {
 		await provisionDeployed(workspace, stage, options);
 		return;
@@ -10985,11 +11209,16 @@ async function provisionDeployed(workspace, stage, options) {
 		...options.retireOldKeys ? { retireOldKeys: true } : {},
 		log: (line) => logger$1.log(line)
 	})).filter((r) => r.mode === "provider");
-	if (configured.length === 0) {
-		logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${provisionCommand(stage)} create it.`);
-		return;
-	}
-	const changes = configured.reduce((n, r) => n + r.actions.length, 0);
+	if (configured.length === 0) logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${provisionCommand(stage)} create it.`);
+	const dns = await provisionStageDns({
+		workspace,
+		stage,
+		...options.dryRun ? { dryRun: true } : {},
+		...options.profile ? { profile: options.profile } : {},
+		log: (line) => logger$1.log(line)
+	});
+	const changes = configured.reduce((n, r) => n + r.actions.length, 0) + dns.changes.filter((c) => c.action !== "unchanged" && c.action !== "manual").length;
+	if (configured.length === 0 && dns.mode === "none") return;
 	logger$1.log(options.dryRun ? `\n${changes === 0 ? "✅ Nothing to change" : `📋 ${changes} change${changes === 1 ? "" : "s"} planned`}` : `\n✅ '${stage}' provisioned${changes === 0 ? " — already up to date" : ` (${changes} change${changes === 1 ? "" : "s"})`}`);
 }
 /**
@@ -11260,6 +11489,7 @@ async function testCommand(options = {}) {
 	const preloadPath = join(gkmDir, "test-credentials-preload.ts");
 	await createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+	if (workspace) await writeStageTypes(workspace.root, workspace.stages);
 	const manifestPath = workspace ? await writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => isAbsolute(app.path) ? app.path : join(workspace.root, app.path))],
@@ -11343,7 +11573,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-ggkPVJRC.mjs");
+	const { migrateAndSeed } = await import("./migrate-CKLJ73OO.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11787,7 +12017,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-ggkPVJRC.mjs");
+		const { migrateCommand } = await import("./migrate-CKLJ73OO.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11801,7 +12031,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-ggkPVJRC.mjs");
+		const { seedCommand } = await import("./migrate-CKLJ73OO.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11815,7 +12045,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-ggkPVJRC.mjs");
+		const { migrationCommand } = await import("./migrate-CKLJ73OO.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11864,7 +12094,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Deployed stage: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11923,7 +12153,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-D_jNqnfZ.mjs");
+		const { secretsAddCommand } = await import("./add-v3tCbrpE.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11934,7 +12164,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-C-8Tt5Hh.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-BQmhq9_y.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11945,7 +12175,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-C-8Tt5Hh.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-BQmhq9_y.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11987,8 +12217,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-BYdrtZsC.mjs").then((n) => n.An);
+		const { reconcileMissingSecrets } = await import("./reconcile-Dh1Jk7WE.mjs");
+		const { secretsStoreFor } = await import("./seeds-perzdN81.mjs").then((n) => n.Pn);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11997,7 +12227,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-BYdrtZsC.mjs").then((n) => n.dt);
+		const { derivedContainers } = await import("./seeds-perzdN81.mjs").then((n) => n.ht);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12015,15 +12245,15 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-Dn7nK6sh.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-CpmO5qnl.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-7edNFwGk.mjs");
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
+	const { deployCli } = await import("./cli-REdO9X5b.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12034,14 +12264,15 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		...options.json ? { json: true } : {},
 		...options.dryRun ? { dryRun: true } : {},
 		...options.atomic ? { atomic: true } : {},
-		...options.allowDevServices ? { allowDevServices: true } : {}
+		...options.allowDevServices ? { allowDevServices: true } : {},
+		...options.skipDnsCheck ? { skipDnsCheck: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-CEE6dse4.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-BTbZlrFV.mjs");
+		const { rollbackStage } = await import("./rollback-DpSU2DsD.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-D8TPK7o9.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12076,7 +12307,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-CZHAtwPT.mjs");
+		const { deployGithubCommand } = await import("./github-xzg99wz8.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12087,7 +12318,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-DoHHz6pS.mjs");
+		const { stagesCommand } = await import("./stages-CnZRYmkI.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12121,13 +12352,17 @@ program.command("deploy:list").description("List Dokploy resources (projects, re
 		process.exit(1);
 	}
 });
-program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
+program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger, godaddy)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const provider = options.service ?? options.provider;
-		if (!["dokploy", "hostinger"].includes(provider)) {
-			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger`);
+		if (![
+			"dokploy",
+			"hostinger",
+			"godaddy"
+		].includes(provider)) {
+			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger, godaddy`);
 			process.exit(1);
 		}
 		await loginCommand({
@@ -12140,7 +12375,7 @@ program.command("login").description("Authenticate with a deployment or DNS prov
 		process.exit(1);
 	}
 });
-program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
+program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, godaddy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12228,6 +12463,6 @@ try {
 }
 program.parse();
 //#endregion
-export { validateDokployToken as a, formatError as i, slug as n, canPrompt as o, stamp as r, prompt as s, generateFullstackCustomSecrets as t };
+export { formatError as a, prompt as c, stamp as i, generateFullstackCustomSecrets as n, validateDokployToken as o, slug as r, canPrompt as s, deploysWithCompose as t };
 
 //# sourceMappingURL=index.mjs.map