@geekmidas/cli 10.0.0-alpha.87 → 10.0.0-alpha.89

package/dist/{workspace-CT0JM3Y8.cjs → workspace-CwW3Gkru.cjs}

@@ -36,6 +36,72 @@ function assertKnownSecretsStore(store) {
 	if (typeof provider === "string" && !SECRETS_STORE_PROVIDERS.includes(provider)) throw new UnknownSecretsStoreProvider(provider);
 }
 //#endregion
+//#region src/compose/dnsConfig.ts
+/**
+* `dns['<root domain>'].records` — how a domain's hosts point at a compose
+* stage's server — checked and read. Pure, and kept apart from the DNS step
+* so the workspace schema checks a config with the same rules and the same
+* named errors the step applies.
+*/
+/** The stage-secret key holding the server's public IPv4 address. */
+const SERVER_IPV4_KEY = "GKM_SERVER_IPV4";
+/** The stage-secret key holding the server's public IPv6 address, if any. */
+const SERVER_IPV6_KEY = "GKM_SERVER_IPV6";
+/**
+* Whether a stage secret is gkm's own — the server's address — and so never
+* written into an app's or a worker's environment.
+*/
+function isReservedStageKey(key) {
+	return key.startsWith("GKM_SERVER_");
+}
+/** A DNS hostname: dot-separated labels of letters, digits and inner '-'. */
+const HOSTNAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/** Whether `value` is a DNS hostname with at least two labels. */
+function isHostname(value) {
+	return typeof value === "string" && HOSTNAME.test(value);
+}
+/** A CNAME target that is not a hostname under its own domain. */
+var DnsTargetInvalid = class extends Error {
+	domain;
+	target;
+	stage;
+	constructor(domain, target, stage) {
+		super(`dns['${domain}'].records.target${stage ? ` for '${stage}'` : ""} is ${JSON.stringify(target)}, which is not a hostname under ${domain}. Every host's CNAME points at it and gkm writes its A record, so it must be a name in the same zone — like 'server.${domain}'.`);
+		this.domain = domain;
+		this.target = target;
+		this.stage = stage;
+		this.name = "DnsTargetInvalid";
+	}
+};
+/** The CNAME target names under one domain, by the stage they are for, checked. */
+function targets(records) {
+	const { target } = records;
+	if (target && typeof target === "object" && !Array.isArray(target)) return Object.entries(target);
+	return [[void 0, target]];
+}
+/**
+* One domain's records mode checked.
+*
+* @throws {DnsTargetInvalid} for a target that is not a hostname under it
+*/
+function checkDnsRecordsMode(domain, records) {
+	if (!records || typeof records !== "object") return;
+	const mode = records;
+	if (mode.mode !== "cname") return;
+	for (const [stage, target] of targets(mode)) {
+		const name = typeof target === "string" ? target.toLowerCase() : target;
+		if (!isHostname(name) || !name.endsWith(`.${domain.toLowerCase()}`)) throw new DnsTargetInvalid(domain, target, stage);
+	}
+}
+/**
+* The CNAME target a domain's hosts point at on `stage`, or `undefined` for
+* A records — including a per-stage map that names no target for it.
+*/
+function cnameTarget(records, stage) {
+	if (!records || records === "a") return void 0;
+	return (typeof records.target === "string" ? records.target : records.target[stage])?.toLowerCase();
+}
+//#endregion
 //#region src/compose/proxy.ts
 /**
 * Which proxy a stage's stack is served by, and with whose certificate —
@@ -688,6 +754,33 @@ var UndeclaredStage = class extends Error {
 		this.name = "UndeclaredStage";
 	}
 };
+/**
+* A per-stage setting keyed by a stage the workspace does not deploy: a typo,
+* a stage since removed, or the local stage, which none of them apply to.
+*/
+var UnknownStageKey = class extends Error {
+	setting;
+	stage;
+	deployed;
+	local;
+	constructor(setting, stage, deployed, local) {
+		super(`${setting} names the stage '${stage}', ` + (stage === local ? `the local stage — ${setting} is read for deployed stages only. ` : "which is not one of this workspace's deployed stages. ") + `It takes ${deployed.length > 0 ? deployed.map((s) => `'${s}'`).join(", ") : "no stage: stages.deployed is empty"} — the stages in stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.deployed = deployed;
+		this.local = local;
+		this.name = "UnknownStageKey";
+	}
+};
+/**
+* The first key of a per-stage map that is not a deployed stage.
+*
+* @throws {UnknownStageKey}
+*/
+function assertDeployedStageKeys(setting, map, stages) {
+	if (!map || !stages?.deployed) return;
+	for (const key of Object.keys(map)) if (!stages.deployed.includes(key)) throw new UnknownStageKey(setting, key, stages.deployed, stages.local);
+}
 //#endregion
 //#region src/workspace/schema.ts
 /** Routes are a glob, or a list of them. */
@@ -894,10 +987,22 @@ require_schemas.object({
 	unchanged: require_schemas.boolean()
 });
 /**
+* How a domain's hosts point at a compose stage's server: an A (and AAAA)
+* record each (`'a'`, the default), or one A record for `target` and a CNAME
+* to it for every other host but the apex. `target` is one name, or one per
+* stage; it must be under the domain.
+*/
+const DnsRecordsModeSchema = require_schemas.union([require_schemas.literal("a"), require_schemas.object({
+	mode: require_schemas.literal("cname"),
+	target: require_schemas.union([require_schemas.string(), require_schemas.record(require_schemas.string(), require_schemas.string())])
+}).strict()]);
+/**
 * Hostinger DNS provider config (without domain - domain is the record key).
 */
 const HostingerDnsProviderSchema = require_schemas.object({
 	provider: require_schemas.literal("hostinger"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** TTL in seconds (default: 300) */
 	ttl: require_schemas.number().int().positive().optional()
 });
@@ -906,6 +1011,8 @@ const HostingerDnsProviderSchema = require_schemas.object({
 */
 const Route53DnsProviderSchema = require_schemas.object({
 	provider: require_schemas.literal("route53"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** AWS region (optional - uses AWS_REGION env var if not provided) */
 	region: AwsRegionSchema.optional(),
 	/** AWS profile name (optional - uses default credential chain if not provided) */
@@ -916,23 +1023,45 @@ const Route53DnsProviderSchema = require_schemas.object({
 	ttl: require_schemas.number().int().positive().optional()
 });
 /**
+* GoDaddy DNS provider config (without domain - domain is the record key).
+*
+* Credentials: `GODADDY_API_TOKEN` (a Personal Access Token scoped to
+* `domains.dns:update`), else `gkm login --provider godaddy`. GoDaddy refuses
+* a TTL under 600 seconds.
+*/
+const GoDaddyDnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("godaddy"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default and minimum: 600) */
+	ttl: require_schemas.number().int().min(600, "GoDaddy's minimum TTL is 600 seconds").optional()
+});
+/**
 * Cloudflare DNS provider config (placeholder for future).
 */
 const CloudflareDnsProviderSchema = require_schemas.object({
 	provider: require_schemas.literal("cloudflare"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** TTL in seconds (default: 300) */
 	ttl: require_schemas.number().int().positive().optional()
 });
 /**
 * Manual DNS configuration (user handles DNS themselves).
 */
-const ManualDnsProviderSchema = require_schemas.object({ provider: require_schemas.literal("manual") });
+const ManualDnsProviderSchema = require_schemas.object({
+	provider: require_schemas.literal("manual"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional()
+});
 /**
 * Custom DNS provider config (user-provided implementation).
 */
 const CustomDnsProviderSchema = require_schemas.object({
 	/** Custom DnsProvider implementation */
 	provider: require_schemas.custom((val) => typeof val === "object" && val !== null && typeof val.name === "string" && typeof val.getRecords === "function" && typeof val.upsertRecords === "function", { message: "Custom DNS provider must implement name, getRecords(), and upsertRecords() methods" }),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** TTL in seconds (default: 300) */
 	ttl: require_schemas.number().int().positive().optional()
 });
@@ -942,6 +1071,7 @@ const CustomDnsProviderSchema = require_schemas.object({
 const BuiltInDnsProviderSchema = require_schemas.discriminatedUnion("provider", [
 	HostingerDnsProviderSchema,
 	Route53DnsProviderSchema,
+	GoDaddyDnsProviderSchema,
 	CloudflareDnsProviderSchema,
 	ManualDnsProviderSchema
 ]);
@@ -964,6 +1094,7 @@ const DnsProviderSchema = require_schemas.union([BuiltInDnsProviderSchema, Custo
 * Supported providers:
 * - 'hostinger': Use Hostinger DNS API
 * - 'route53': Use AWS Route53
+* - 'godaddy': Use GoDaddy's v1 DNS API
 * - 'cloudflare': Use Cloudflare DNS API (future)
 * - 'manual': Don't create records, just print required records
 * - Custom: Provide a DnsProvider implementation
@@ -971,20 +1102,19 @@ const DnsProviderSchema = require_schemas.union([BuiltInDnsProviderSchema, Custo
 const DnsConfigSchema = require_schemas.record(require_schemas.string(), DnsProviderSchema);
 const HostingerDnsConfigSchema = HostingerDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
 const Route53DnsConfigSchema = Route53DnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
+const GoDaddyDnsConfigSchema = GoDaddyDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
 const CloudflareDnsConfigSchema = CloudflareDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
 const ManualDnsConfigSchema = ManualDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
 const CustomDnsConfigSchema = CustomDnsProviderSchema.extend({ domain: require_schemas.string().min(1, "Domain is required") });
 const BuiltInDnsConfigSchema = require_schemas.discriminatedUnion("provider", [
 	HostingerDnsConfigSchema,
 	Route53DnsConfigSchema,
+	GoDaddyDnsConfigSchema,
 	CloudflareDnsConfigSchema,
 	ManualDnsConfigSchema
 ]);
 const LegacyDnsConfigSchema = require_schemas.union([BuiltInDnsConfigSchema, CustomDnsConfigSchema]);
-/**
-* Combined DNS config that supports both new multi-domain and legacy single-domain formats.
-*/
-const DnsConfigWithLegacySchema = require_schemas.union([DnsConfigSchema, LegacyDnsConfigSchema]);
+require_schemas.union([DnsConfigSchema, LegacyDnsConfigSchema]);
 /**
 * Backups configuration schema.
 *
@@ -1074,15 +1204,12 @@ const DeployConfigSchema = require_schemas.object({
 	}).optional(),
 	/** Whose deploy this is, on a target shared with other workspaces. */
 	namespace: require_schemas.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "deploy.namespace must be lowercase letters and digits with single '-' between them").optional(),
-	/** Each deployed stage's base domain (stage name -> domain). */
-	domains: require_schemas.record(require_schemas.string(), require_schemas.string()).optional(),
 	/** Where every target pushes and pulls the apps' images. */
 	registry: require_schemas.string().min(1).optional(),
 	dokploy: DokployWorkspaceConfigSchema.optional(),
 	compose: ComposeWorkspaceConfigSchema.optional(),
 	telemetry: TelemetryConfigSchema.optional(),
 	objects: ObjectsConfigSchema.optional(),
-	dns: DnsConfigWithLegacySchema.optional(),
 	backups: BackupsConfigSchema.optional()
 });
 /**
@@ -1275,6 +1402,10 @@ const WorkspaceConfigSchema = require_schemas.object({
 	*/
 	apps: require_schemas.record(require_schemas.string(), AppConfigSchema).optional(),
 	shared: SharedConfigSchema.optional(),
+	/** Each deployed stage's base domain (stage name -> domain). */
+	domains: require_schemas.record(require_schemas.string(), require_schemas.string()).optional(),
+	/** Each root domain's DNS provider, and how its hosts are pointed. */
+	dns: DnsConfigSchema.optional(),
 	deploy: DeployConfigSchema.optional(),
 	stages: StagesConfigSchema,
 	secrets: SecretsConfigSchema.optional(),
@@ -1340,6 +1471,59 @@ const WorkspaceConfigSchema = require_schemas.object({
 			path: ["deploy", "compose"]
 		});
 	}
+	const perStage = [
+		[
+			"domains",
+			["domains"],
+			data.domains
+		],
+		[
+			"deploy.objects",
+			["deploy", "objects"],
+			data.deploy?.objects
+		],
+		[
+			"deploy.telemetry",
+			["deploy", "telemetry"],
+			data.deploy?.telemetry
+		],
+		...Object.entries(data.dns ?? {}).map(([domain, entry]) => {
+			const records = entry.records;
+			const target = records && typeof records === "object" ? records.target : void 0;
+			return [
+				`dns['${domain}'].records.target`,
+				[
+					"dns",
+					domain,
+					"records",
+					"target"
+				],
+				target && typeof target === "object" ? target : void 0
+			];
+		})
+	];
+	for (const [setting, path, map] of perStage) try {
+		assertDeployedStageKeys(setting, map, data.stages);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path
+		});
+	}
+	for (const [domain, entry] of Object.entries(data.dns ?? {})) try {
+		checkDnsRecordsMode(domain, entry.records);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [
+				"dns",
+				domain,
+				"records"
+			]
+		});
+	}
 	if (data.state?.provider === "ssm" && !data.name) ctx.addIssue({
 		code: "custom",
 		message: "Workspace name is required when using SSM state provider. Add \"name\" to your gkm.config.ts.",
@@ -1401,6 +1585,8 @@ const WORKSPACE_KEYS = /* @__PURE__ */ new Set([
 	"constructs",
 	"apps",
 	"shared",
+	"domains",
+	"dns",
 	"deploy",
 	"stages",
 	"secrets",
@@ -1534,6 +1720,8 @@ function normalizeWorkspace(config, cwd) {
 		root: cwd,
 		...config.constructs ? { constructs: config.constructs } : {},
 		apps: normalizedApps,
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
 		deploy: config.deploy ?? { default: "dokploy" },
 		shared: config.shared ?? { packages: ["packages/*"] },
 		stages: validateStages(config.stages),
@@ -1579,6 +1767,8 @@ function wrapSingleAppAsWorkspace(config, cwd) {
 			runtime: config.runtime,
 			env: config.env
 		} },
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
 		deploy: {
 			default: "dokploy",
 			...config.deploy
@@ -1609,10 +1799,41 @@ var DokployRegistryMoved = class extends Error {
 		this.name = "DokployRegistryMoved";
 	}
 };
+/**
+* `deploy.domains`, which became `domains` at the root of the config: a stage's
+* domain is a fact about the product every target and every command reads,
+* not a deploy setting.
+*/
+var DomainsMoved = class extends Error {
+	domains;
+	constructor(domains) {
+		super(`deploy.domains is now domains, at the root of gkm.config.ts. Move it out of deploy: defineWorkspace({ …, domains: ${JSON.stringify(domains)}, deploy: { … } }).`);
+		this.domains = domains;
+		this.name = "DomainsMoved";
+	}
+};
+/**
+* `deploy.dns`, which became `dns` at the root of the config, keyed by root
+* domain.
+*/
+var DnsMoved = class extends Error {
+	dns;
+	constructor(dns) {
+		const legacy = dns && typeof dns === "object" && "domain" in dns && "provider" in dns;
+		const { domain, ...rest } = legacy ? dns : {};
+		super(`deploy.dns is now dns, at the root of gkm.config.ts, keyed by root domain. Move it out of deploy: defineWorkspace({ …, dns: ${JSON.stringify(legacy ? { [String(domain)]: rest } : dns)}, deploy: { … } }).`);
+		this.dns = dns;
+		this.name = "DnsMoved";
+	}
+};
 /** Refuse a deploy key that has moved, naming where it lives now. */
 function assertNoMovedDeployKeys(deploy) {
 	const dokploy = deploy?.dokploy;
 	if (dokploy && typeof dokploy === "object" && "registry" in dokploy) throw new DokployRegistryMoved(dokploy.registry);
+	if (deploy && typeof deploy === "object") {
+		if ("domains" in deploy) throw new DomainsMoved(deploy.domains);
+		if ("dns" in deploy) throw new DnsMoved(deploy.dns);
+	}
 }
 function processConfig(config, cwd) {
 	assertNoMovedDeployKeys(config.deploy);
@@ -1782,12 +2003,24 @@ Object.defineProperty(exports, "ComposeTlsFileMissing", {
 		return ComposeTlsFileMissing;
 	}
 });
+Object.defineProperty(exports, "DnsMoved", {
+	enumerable: true,
+	get: function() {
+		return DnsMoved;
+	}
+});
 Object.defineProperty(exports, "DokployRegistryMoved", {
 	enumerable: true,
 	get: function() {
 		return DokployRegistryMoved;
 	}
 });
+Object.defineProperty(exports, "DomainsMoved", {
+	enumerable: true,
+	get: function() {
+		return DomainsMoved;
+	}
+});
 Object.defineProperty(exports, "IamUserNotOwned", {
 	enumerable: true,
 	get: function() {
@@ -1860,6 +2093,18 @@ Object.defineProperty(exports, "SECRETS_STORE_PROVIDERS", {
 		return SECRETS_STORE_PROVIDERS;
 	}
 });
+Object.defineProperty(exports, "SERVER_IPV4_KEY", {
+	enumerable: true,
+	get: function() {
+		return SERVER_IPV4_KEY;
+	}
+});
+Object.defineProperty(exports, "SERVER_IPV6_KEY", {
+	enumerable: true,
+	get: function() {
+		return SERVER_IPV6_KEY;
+	}
+});
 Object.defineProperty(exports, "SUPPORTED_DEPLOY_TARGETS", {
 	enumerable: true,
 	get: function() {
@@ -1932,6 +2177,12 @@ Object.defineProperty(exports, "checkS3Config", {
 		return checkS3Config;
 	}
 });
+Object.defineProperty(exports, "cnameTarget", {
+	enumerable: true,
+	get: function() {
+		return cnameTarget;
+	}
+});
 Object.defineProperty(exports, "constructPatterns", {
 	enumerable: true,
 	get: function() {
@@ -1998,6 +2249,12 @@ Object.defineProperty(exports, "isPhase2DeployTarget", {
 		return isPhase2DeployTarget;
 	}
 });
+Object.defineProperty(exports, "isReservedStageKey", {
+	enumerable: true,
+	get: function() {
+		return isReservedStageKey;
+	}
+});
 Object.defineProperty(exports, "isWorkspaceConfig", {
 	enumerable: true,
 	get: function() {
@@ -2095,4 +2352,4 @@ Object.defineProperty(exports, "wrapSingleAppAsWorkspace", {
 	}
 });
 
-//# sourceMappingURL=workspace-CT0JM3Y8.cjs.map
+//# sourceMappingURL=workspace-CwW3Gkru.cjs.map