@geekmidas/cli 10.0.0-alpha.88 → 10.0.0-alpha.89

package/dist/{index-elsLJTUv.d.cts → index-YFNxR5Ns.d.mts}

@@ -1,4 +1,4 @@
-import { D as WorkspaceConfig, O as WorkspaceInput, _ as InferredWorkspaceConfig, a as Routes, j as Framework, l as AppsRecord, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-0oAyFOfR.cjs";
+import { D as WorkspaceConfig, O as WorkspaceInput, _ as InferredWorkspaceConfig, a as Routes, j as Framework, l as AppsRecord, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-ZHuZ89hv.mjs";
 //#region src/workspace/publicEnv.d.ts
 /**
  * All public env-var prefixes the toolbox understands.
@@ -68,7 +68,7 @@ declare function stripPublicPrefix(name: string): string | null;
  * // config.apps.foo <- TypeScript error
  * ```
  */
-declare function defineWorkspace<const TApps extends AppsRecord>(config: WorkspaceInput<TApps>): InferredWorkspaceConfig<TApps>;
+declare function defineWorkspace<const TApps extends AppsRecord, const TDeployed extends string = string>(config: WorkspaceInput<TApps, TDeployed>): InferredWorkspaceConfig<TApps>;
 /**
  * Normalize a workspace configuration with resolved defaults.
  */
@@ -93,6 +93,23 @@ declare class DokployRegistryMoved extends Error {
   readonly registry: unknown;
   constructor(registry: unknown);
 }
+/**
+ * `deploy.domains`, which became `domains` at the root of the config: a stage's
+ * domain is a fact about the product every target and every command reads,
+ * not a deploy setting.
+ */
+declare class DomainsMoved extends Error {
+  readonly domains: unknown;
+  constructor(domains: unknown);
+}
+/**
+ * `deploy.dns`, which became `dns` at the root of the config, keyed by root
+ * domain.
+ */
+declare class DnsMoved extends Error {
+  readonly dns: unknown;
+  constructor(dns: unknown);
+}
 /** Refuse a deploy key that has moved, naming where it lives now. */
 declare function assertNoMovedDeployKeys(deploy: unknown): void;
 declare function processConfig(config: GkmConfig | WorkspaceConfig, cwd: string): LoadedConfig;
@@ -169,5 +186,5 @@ declare function getEndpointForStage(dokployConfig: {
   endpoints?: Record<string, string>;
 } | undefined, stage: string): string | undefined;
 //#endregion
-export { stripPublicPrefix as _, assertNoMovedDeployKeys as a, getAppBuildOrder as c, normalizeWorkspace as d, processConfig as f, getPublicEnvPrefix as g, PUBLIC_ENV_PREFIXES as h, appConstructGlobs as i, getAppGkmConfig as l, wrapSingleAppAsWorkspace as m, InvalidWorkspaceConfig as n, constructPatterns as o, workspaceConstructGlobs as p, allConstructGlobs as r, defineWorkspace as s, DokployRegistryMoved as t, getEndpointForStage as u };
-//# sourceMappingURL=index-elsLJTUv.d.cts.map
+export { PUBLIC_ENV_PREFIXES as _, allConstructGlobs as a, constructPatterns as c, getAppGkmConfig as d, getEndpointForStage as f, wrapSingleAppAsWorkspace as g, workspaceConstructGlobs as h, InvalidWorkspaceConfig as i, defineWorkspace as l, processConfig as m, DokployRegistryMoved as n, appConstructGlobs as o, normalizeWorkspace as p, DomainsMoved as r, assertNoMovedDeployKeys as s, DnsMoved as t, getAppBuildOrder as u, getPublicEnvPrefix as v, stripPublicPrefix as y };
+//# sourceMappingURL=index-YFNxR5Ns.d.mts.map

package/dist/index-YFNxR5Ns.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-YFNxR5Ns.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBCgFlB,sBACT,cAAc,kBACd,mCACL,QAAQ,eAAe,OAAO,aAAa,wBAAwB;;;;iBAiCrD,mBACf,QAAQ,iBACR,cACE;;;;;iBAkDa,yBACf,QAAQ,WACR,cACE;;;;;;;;;;;;cAgEU,6BAA6B;WACpB;EAArB,YAAqB;;;;;;;cAcT,qBAAqB;WACZ;EAArB,YAAqB;;;;;;cAaT,iBAAiB;WACR;EAArB,YAAqB;;;iBAcN,wBAAwB;iBAaxB,cACf,QAAQ,YAAY,iBACpB,cACE;;cAiCU,+BAA+B;EAC3C,YAAY;;;;;;;;iBAYG,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAS1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAgCa,iBAAiB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoD5B,oBACf;EACK;EAAmB,YAAY;eAEpC"}

package/dist/index.cjs

@@ -1,24 +1,24 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-tr26-KML.cjs");
+const require_credentials = require("./credentials-BKfIugu2.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CT0JM3Y8.cjs");
+const require_workspace = require("./workspace-CwW3Gkru.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-CsI0A_Ef.cjs");
+const require_seeds = require("./seeds-CN6tB-va.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
 const require_drivers = require("./drivers-LYSdQDmd.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_local = require("./local-Cq8qdgNX.cjs");
-const require_sniffer = require("./sniffer-DJYupBeK.cjs");
-const require_deploy = require("./deploy-CtbZj4zN.cjs");
-const require_compose = require("./compose-xw86kVYi.cjs");
+const require_local = require("./local-BjxDfPvy.cjs");
+const require_sniffer = require("./sniffer-IAQEpsQb.cjs");
+const require_deploy = require("./deploy-DbBGo3a6.cjs");
+const require_compose = require("./compose-BvrhDwJ6.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
-const require_LocalStateStore = require("./LocalStateStore-CLwa2DpK.cjs");
+const require_LocalStateStore = require("./LocalStateStore-CUWh2BWU.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 const require_ready = require("./ready-BpNbORRB.cjs");
 let node_path = require("node:path");
@@ -53,7 +53,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.88";
+var version = "10.0.0-alpha.89";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -136,7 +136,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DJYupBeK.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-IAQEpsQb.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -183,6 +183,10 @@ async function loginCommand(options) {
 		logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
 		logger$8.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
+	if (provider === "godaddy") {
+		await loginGoDaddy(options);
+		return;
+	}
 	if (provider === "hostinger") {
 		logger$8.log("\n🔐 Logging in to Hostinger...\n");
 		let token = providedToken;
@@ -205,15 +209,50 @@ async function loginCommand(options) {
 	}
 }
 /**
+* Store a GoDaddy Personal Access Token. Not validated: the only call that
+* proves a token without a domain is an account call (`GET /v1/domains`),
+* which a token scoped to `domains.dns:update` alone may not make — the first
+* `gkm setup` that writes a record is where a bad token reports itself.
+*/
+async function loginGoDaddy(options) {
+	logger$8.log("\n🔐 Logging in to GoDaddy...\n");
+	let token = options.token;
+	if (!token) {
+		logger$8.log("\nCreate a Personal Access Token in the GoDaddy developer dashboard\n(https://developer.godaddy.com) with only the domains.dns:update scope.\n");
+		token = await prompt("Personal Access Token: ", {
+			hidden: true,
+			instead: LOGIN_INSTEAD
+		});
+	}
+	if (!token) {
+		logger$8.error("Token is required");
+		process.exit(1);
+	}
+	const where = options.home ? { home: options.home } : void 0;
+	await require_credentials.storeGoDaddyToken(token, where);
+	logger$8.log("\n✓ GoDaddy token stored.");
+	logger$8.log(`  Token: ${maskToken(token)}`);
+	logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath(where)}`);
+	logger$8.log("  Not validated here: proving a token without a domain needs an account\n  scope a DNS-only token does not have, so the first gkm setup that\n  writes a record is where a bad token reports itself.");
+	logger$8.log("\nYou can now use it as a DNS provider without setting GODADDY_API_TOKEN.");
+}
+/**
 * Logout from a service
 */
 async function logoutCommand(options) {
 	const { provider = "dokploy" } = options;
 	if (provider === "all") {
-		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from all services");
+		const dokployRemoved = await require_credentials.removeDokployCredentials();
+		const godaddyRemoved = await require_credentials.removeGoDaddyCredentials();
+		if (dokployRemoved || godaddyRemoved) logger$8.log("\n✓ Logged out from all services");
 		else logger$8.log("\nNo stored credentials found");
 		return;
 	}
+	if (provider === "godaddy") {
+		const removed = await require_credentials.removeGoDaddyCredentials();
+		logger$8.log(removed ? "\n✓ Logged out from GoDaddy" : "\nNo GoDaddy credentials found");
+		return;
+	}
 	if (provider === "dokploy") {
 		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from Dokploy");
 		else logger$8.log("\nNo Dokploy credentials found");
@@ -230,6 +269,8 @@ async function whoamiCommand() {
 		logger$8.log(`    Endpoint: ${dokploy.endpoint}`);
 		logger$8.log(`    Token: ${maskToken(dokploy.token)}`);
 	} else logger$8.log("  Dokploy: Not logged in");
+	const godaddy = (await require_credentials.readCredentials()).godaddy;
+	logger$8.log(godaddy ? `  GoDaddy:\n    Token: ${maskToken(godaddy.token)}` : "  GoDaddy: Not logged in");
 	logger$8.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
 }
 /**
@@ -2289,9 +2330,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3344,7 +3385,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-1REMhKps.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C4NmpRTD.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3489,7 +3530,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-1REMhKps.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C4NmpRTD.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3575,7 +3616,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-1REMhKps.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C4NmpRTD.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3869,6 +3910,7 @@ async function composeCommand(options, deps = {}) {
 		...options.dryRun ? { dryRun: true } : {},
 		...options.push ? { buildOnly: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
+		...options.skipDnsCheck ? { skipDnsCheck: true } : {},
 		logger: {
 			info: (message) => console.log(message),
 			warn: (message) => console.warn(message),
@@ -5276,25 +5318,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.88",
-	"@geekmidas/auth": "~10.0.0-alpha.88",
-	"@geekmidas/cache": "~10.0.0-alpha.88",
-	"@geekmidas/client": "~10.0.0-alpha.88",
-	"@geekmidas/cloud": "~10.0.0-alpha.88",
-	"@geekmidas/constructs": "~10.0.0-alpha.88",
-	"@geekmidas/db": "~10.0.0-alpha.88",
-	"@geekmidas/emailkit": "~10.0.0-alpha.88",
-	"@geekmidas/envkit": "~10.0.0-alpha.88",
-	"@geekmidas/errors": "~10.0.0-alpha.88",
-	"@geekmidas/events": "~10.0.0-alpha.88",
-	"@geekmidas/logger": "~10.0.0-alpha.88",
-	"@geekmidas/manifest": "~10.0.0-alpha.88",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.88",
-	"@geekmidas/schema": "~10.0.0-alpha.88",
-	"@geekmidas/services": "~10.0.0-alpha.88",
-	"@geekmidas/storage": "~10.0.0-alpha.88",
-	"@geekmidas/telescope": "~10.0.0-alpha.88",
-	"@geekmidas/testkit": "~10.0.0-alpha.88",
+	"@geekmidas/audit": "~10.0.0-alpha.89",
+	"@geekmidas/auth": "~10.0.0-alpha.89",
+	"@geekmidas/cache": "~10.0.0-alpha.89",
+	"@geekmidas/client": "~10.0.0-alpha.89",
+	"@geekmidas/cloud": "~10.0.0-alpha.89",
+	"@geekmidas/constructs": "~10.0.0-alpha.89",
+	"@geekmidas/db": "~10.0.0-alpha.89",
+	"@geekmidas/emailkit": "~10.0.0-alpha.89",
+	"@geekmidas/envkit": "~10.0.0-alpha.89",
+	"@geekmidas/errors": "~10.0.0-alpha.89",
+	"@geekmidas/events": "~10.0.0-alpha.89",
+	"@geekmidas/logger": "~10.0.0-alpha.89",
+	"@geekmidas/manifest": "~10.0.0-alpha.89",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.89",
+	"@geekmidas/schema": "~10.0.0-alpha.89",
+	"@geekmidas/services": "~10.0.0-alpha.89",
+	"@geekmidas/storage": "~10.0.0-alpha.89",
+	"@geekmidas/telescope": "~10.0.0-alpha.89",
+	"@geekmidas/testkit": "~10.0.0-alpha.89",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5695,7 +5737,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "5bd5a7422c74b30cb3c285d0717da882171c103a", version = cliVersion()) {
+function stagesActionUses(commit = "e1be097c3e5909843479a2dcd97f06e952f5b1aa", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -10977,6 +11019,135 @@ function maskUrl(url) {
 	}
 }
 //#endregion
+//#region src/providers/dns.ts
+/** Whether the workspace deploys through the compose target. */
+function deploysWithCompose(workspace) {
+	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
+}
+/**
+* A compose stage that serves a domain has its server's address in its
+* secrets — checked before `gkm setup --stage` does anything else.
+*
+* @throws {ServerAddressMissing} for a compose stage with a domain and none
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function assertStageServer(workspace, stage, secrets) {
+	if (stage === workspace.stages.local) return void 0;
+	if (!deploysWithCompose(workspace)) return require_compose.serverAddress(stage, secrets?.custom);
+	return require_compose.requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+}
+/**
+* The hosts a compose stage serves: its stack composed as a deploy would —
+* with the secrets it would generate made up in memory, never written — and
+* every route's host read off it.
+*/
+async function composeStageHosts(options) {
+	const { workspace, stage } = options;
+	const runnables = options.runnables ?? {};
+	const background = options.background ?? {};
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: require_seeds.constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables,
+		background
+	});
+	const stored = await (await require_seeds.secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	})).read(stage);
+	const { deployedStackSecrets } = await Promise.resolve().then(() => require("./compose-BvrhDwJ6.cjs")).then((n) => n.secrets_exports);
+	const { composeStack } = await Promise.resolve().then(() => require("./compose-BvrhDwJ6.cjs")).then((n) => n.stack_exports);
+	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity: require_seeds.deployIdentity(workspace, stage),
+		images: {
+			mode: "pull",
+			tag: "dns",
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		buildOnly: true,
+		allowDevServices: true
+	});
+	return require_compose.stackHosts(stack);
+}
+/**
+* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
+* records, created or corrected. A dry run reads and prints, and writes
+* nothing.
+*/
+async function provisionStageDns(options) {
+	const { workspace, stage } = options;
+	const log = options.log ?? ((line) => console.log(line));
+	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
+		mode: "none",
+		hosts: [],
+		changes: []
+	};
+	const store = await require_seeds.secretsStoreFor(workspace, stage, {
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {}
+	});
+	const server = require_compose.serverAddress(stage, (await store.read(stage))?.custom);
+	if (!server) {
+		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${require_compose.serverAddressHint(stage)}`);
+		return {
+			mode: "none",
+			hosts: [],
+			changes: []
+		};
+	}
+	const hosts = [...options.hosts ?? await composeStageHosts({
+		workspace,
+		stage,
+		...options.profile ? { profile: options.profile } : {},
+		...options.home ? { home: options.home } : {},
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.runnables ? { runnables: options.runnables } : {},
+		...options.background ? { background: options.background } : {}
+	})];
+	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
+	const plan = require_compose.planStackDns({
+		stage,
+		hosts,
+		server,
+		dns: workspace.dns
+	});
+	try {
+		return {
+			mode: "records",
+			hosts,
+			changes: await require_compose.applyStackDns(plan, {
+				...options.dryRun ? { dryRun: true } : {},
+				log,
+				credentials: {
+					env: options.env ?? process.env,
+					...options.home ? { home: options.home } : {},
+					log
+				},
+				...options.providerFor ? { providerFor: options.providerFor } : {}
+			})
+		};
+	} catch (error) {
+		if (error instanceof require_credentials.MissingCredential) {
+			log(`   ⚠ ${error.message}`);
+			log("   Until then, create these records yourself:");
+			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
+			return {
+				mode: "records",
+				hosts,
+				changes: []
+			};
+		}
+		throw error;
+	}
+}
+//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
@@ -11010,6 +11181,7 @@ async function setupCommand(options = {}) {
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
+	if (!local) assertStageServer(workspace, stage, await (await require_seeds.secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
 	if (!local && options.dryRun) {
 		await provisionDeployed(workspace, stage, options);
 		return;
@@ -11043,11 +11215,16 @@ async function provisionDeployed(workspace, stage, options) {
 		...options.retireOldKeys ? { retireOldKeys: true } : {},
 		log: (line) => logger$1.log(line)
 	})).filter((r) => r.mode === "provider");
-	if (configured.length === 0) {
-		logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${require_seeds.provisionCommand(stage)} create it.`);
-		return;
-	}
-	const changes = configured.reduce((n, r) => n + r.actions.length, 0);
+	if (configured.length === 0) logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${require_seeds.provisionCommand(stage)} create it.`);
+	const dns = await provisionStageDns({
+		workspace,
+		stage,
+		...options.dryRun ? { dryRun: true } : {},
+		...options.profile ? { profile: options.profile } : {},
+		log: (line) => logger$1.log(line)
+	});
+	const changes = configured.reduce((n, r) => n + r.actions.length, 0) + dns.changes.filter((c) => c.action !== "unchanged" && c.action !== "manual").length;
+	if (configured.length === 0 && dns.mode === "none") return;
 	logger$1.log(options.dryRun ? `\n${changes === 0 ? "✅ Nothing to change" : `📋 ${changes} change${changes === 1 ? "" : "s"} planned`}` : `\n✅ '${stage}' provisioned${changes === 0 ? " — already up to date" : ` (${changes} change${changes === 1 ? "" : "s"})`}`);
 }
 /**
@@ -11402,7 +11579,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-D1It5r_h.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -11846,7 +12023,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11860,7 +12037,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11874,7 +12051,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-B1rVlwj1.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-7xayVtzL.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11923,7 +12100,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Deployed stage: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11982,7 +12159,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-5MZAXybv.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-C9qX4Juc.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11993,7 +12170,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CDn7BH5O.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-BrN_9_CM.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12004,7 +12181,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CDn7BH5O.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-BrN_9_CM.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12047,7 +12224,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CsI0A_Ef.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CN6tB-va.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12056,7 +12233,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CsI0A_Ef.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CN6tB-va.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12074,15 +12251,15 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-B16qgYTn.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-DPF7ZF8M.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-BL8ZHsLQ.cjs"));
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-C85Dut8K.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12093,14 +12270,15 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		...options.json ? { json: true } : {},
 		...options.dryRun ? { dryRun: true } : {},
 		...options.atomic ? { atomic: true } : {},
-		...options.allowDevServices ? { allowDevServices: true } : {}
+		...options.allowDevServices ? { allowDevServices: true } : {},
+		...options.skipDnsCheck ? { skipDnsCheck: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-DFMiBWf0.cjs")).then((n) => n.rollback_exports);
-		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-COv23heb.cjs"));
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-65VVIdBM.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-DuapRxh6.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12135,7 +12313,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DFhuJQlp.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-Bf7pz6AV.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12146,7 +12324,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-Brn3vcdy.cjs"));
+		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-CUn6gvXL.cjs"));
 		await stagesCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12180,13 +12358,17 @@ program.command("deploy:list").description("List Dokploy resources (projects, re
 		process.exit(1);
 	}
 });
-program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
+program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger, godaddy)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const provider = options.service ?? options.provider;
-		if (!["dokploy", "hostinger"].includes(provider)) {
-			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger`);
+		if (![
+			"dokploy",
+			"hostinger",
+			"godaddy"
+		].includes(provider)) {
+			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger, godaddy`);
 			process.exit(1);
 		}
 		await loginCommand({
@@ -12199,7 +12381,7 @@ program.command("login").description("Authenticate with a deployment or DNS prov
 		process.exit(1);
 	}
 });
-program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
+program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, godaddy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12288,6 +12470,7 @@ try {
 program.parse();
 //#endregion
 exports.canPrompt = canPrompt;
+exports.deploysWithCompose = deploysWithCompose;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.prompt = prompt;