@geekmidas/cli 10.0.0-alpha.88 → 10.0.0-alpha.89

package/dist/{workspace-D2CYLMCW.mjs → workspace-CJ0lKFq-.mjs}

@@ -37,6 +37,72 @@ function assertKnownSecretsStore(store) {
 	if (typeof provider === "string" && !SECRETS_STORE_PROVIDERS.includes(provider)) throw new UnknownSecretsStoreProvider(provider);
 }
 //#endregion
+//#region src/compose/dnsConfig.ts
+/**
+* `dns['<root domain>'].records` — how a domain's hosts point at a compose
+* stage's server — checked and read. Pure, and kept apart from the DNS step
+* so the workspace schema checks a config with the same rules and the same
+* named errors the step applies.
+*/
+/** The stage-secret key holding the server's public IPv4 address. */
+const SERVER_IPV4_KEY = "GKM_SERVER_IPV4";
+/** The stage-secret key holding the server's public IPv6 address, if any. */
+const SERVER_IPV6_KEY = "GKM_SERVER_IPV6";
+/**
+* Whether a stage secret is gkm's own — the server's address — and so never
+* written into an app's or a worker's environment.
+*/
+function isReservedStageKey(key) {
+	return key.startsWith("GKM_SERVER_");
+}
+/** A DNS hostname: dot-separated labels of letters, digits and inner '-'. */
+const HOSTNAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/** Whether `value` is a DNS hostname with at least two labels. */
+function isHostname(value) {
+	return typeof value === "string" && HOSTNAME.test(value);
+}
+/** A CNAME target that is not a hostname under its own domain. */
+var DnsTargetInvalid = class extends Error {
+	domain;
+	target;
+	stage;
+	constructor(domain, target, stage) {
+		super(`dns['${domain}'].records.target${stage ? ` for '${stage}'` : ""} is ${JSON.stringify(target)}, which is not a hostname under ${domain}. Every host's CNAME points at it and gkm writes its A record, so it must be a name in the same zone — like 'server.${domain}'.`);
+		this.domain = domain;
+		this.target = target;
+		this.stage = stage;
+		this.name = "DnsTargetInvalid";
+	}
+};
+/** The CNAME target names under one domain, by the stage they are for, checked. */
+function targets(records) {
+	const { target } = records;
+	if (target && typeof target === "object" && !Array.isArray(target)) return Object.entries(target);
+	return [[void 0, target]];
+}
+/**
+* One domain's records mode checked.
+*
+* @throws {DnsTargetInvalid} for a target that is not a hostname under it
+*/
+function checkDnsRecordsMode(domain, records) {
+	if (!records || typeof records !== "object") return;
+	const mode = records;
+	if (mode.mode !== "cname") return;
+	for (const [stage, target] of targets(mode)) {
+		const name = typeof target === "string" ? target.toLowerCase() : target;
+		if (!isHostname(name) || !name.endsWith(`.${domain.toLowerCase()}`)) throw new DnsTargetInvalid(domain, target, stage);
+	}
+}
+/**
+* The CNAME target a domain's hosts point at on `stage`, or `undefined` for
+* A records — including a per-stage map that names no target for it.
+*/
+function cnameTarget(records, stage) {
+	if (!records || records === "a") return void 0;
+	return (typeof records.target === "string" ? records.target : records.target[stage])?.toLowerCase();
+}
+//#endregion
 //#region src/compose/proxy.ts
 /**
 * Which proxy a stage's stack is served by, and with whose certificate —
@@ -689,6 +755,33 @@ var UndeclaredStage = class extends Error {
 		this.name = "UndeclaredStage";
 	}
 };
+/**
+* A per-stage setting keyed by a stage the workspace does not deploy: a typo,
+* a stage since removed, or the local stage, which none of them apply to.
+*/
+var UnknownStageKey = class extends Error {
+	setting;
+	stage;
+	deployed;
+	local;
+	constructor(setting, stage, deployed, local) {
+		super(`${setting} names the stage '${stage}', ` + (stage === local ? `the local stage — ${setting} is read for deployed stages only. ` : "which is not one of this workspace's deployed stages. ") + `It takes ${deployed.length > 0 ? deployed.map((s) => `'${s}'`).join(", ") : "no stage: stages.deployed is empty"} — the stages in stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.deployed = deployed;
+		this.local = local;
+		this.name = "UnknownStageKey";
+	}
+};
+/**
+* The first key of a per-stage map that is not a deployed stage.
+*
+* @throws {UnknownStageKey}
+*/
+function assertDeployedStageKeys(setting, map, stages) {
+	if (!map || !stages?.deployed) return;
+	for (const key of Object.keys(map)) if (!stages.deployed.includes(key)) throw new UnknownStageKey(setting, key, stages.deployed, stages.local);
+}
 //#endregion
 //#region src/workspace/schema.ts
 /** Routes are a glob, or a list of them. */
@@ -895,10 +988,22 @@ object({
 	unchanged: boolean()
 });
 /**
+* How a domain's hosts point at a compose stage's server: an A (and AAAA)
+* record each (`'a'`, the default), or one A record for `target` and a CNAME
+* to it for every other host but the apex. `target` is one name, or one per
+* stage; it must be under the domain.
+*/
+const DnsRecordsModeSchema = union([literal("a"), object({
+	mode: literal("cname"),
+	target: union([string(), record(string(), string())])
+}).strict()]);
+/**
 * Hostinger DNS provider config (without domain - domain is the record key).
 */
 const HostingerDnsProviderSchema = object({
 	provider: literal("hostinger"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** TTL in seconds (default: 300) */
 	ttl: number().int().positive().optional()
 });
@@ -907,6 +1012,8 @@ const HostingerDnsProviderSchema = object({
 */
 const Route53DnsProviderSchema = object({
 	provider: literal("route53"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** AWS region (optional - uses AWS_REGION env var if not provided) */
 	region: AwsRegionSchema.optional(),
 	/** AWS profile name (optional - uses default credential chain if not provided) */
@@ -917,23 +1024,45 @@ const Route53DnsProviderSchema = object({
 	ttl: number().int().positive().optional()
 });
 /**
+* GoDaddy DNS provider config (without domain - domain is the record key).
+*
+* Credentials: `GODADDY_API_TOKEN` (a Personal Access Token scoped to
+* `domains.dns:update`), else `gkm login --provider godaddy`. GoDaddy refuses
+* a TTL under 600 seconds.
+*/
+const GoDaddyDnsProviderSchema = object({
+	provider: literal("godaddy"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
+	/** TTL in seconds (default and minimum: 600) */
+	ttl: number().int().min(600, "GoDaddy's minimum TTL is 600 seconds").optional()
+});
+/**
 * Cloudflare DNS provider config (placeholder for future).
 */
 const CloudflareDnsProviderSchema = object({
 	provider: literal("cloudflare"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** TTL in seconds (default: 300) */
 	ttl: number().int().positive().optional()
 });
 /**
 * Manual DNS configuration (user handles DNS themselves).
 */
-const ManualDnsProviderSchema = object({ provider: literal("manual") });
+const ManualDnsProviderSchema = object({
+	provider: literal("manual"),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional()
+});
 /**
 * Custom DNS provider config (user-provided implementation).
 */
 const CustomDnsProviderSchema = object({
 	/** Custom DnsProvider implementation */
 	provider: custom((val) => typeof val === "object" && val !== null && typeof val.name === "string" && typeof val.getRecords === "function" && typeof val.upsertRecords === "function", { message: "Custom DNS provider must implement name, getRecords(), and upsertRecords() methods" }),
+	/** How the hosts point at a compose stage's server — see {@link DnsRecordsModeSchema}. */
+	records: DnsRecordsModeSchema.optional(),
 	/** TTL in seconds (default: 300) */
 	ttl: number().int().positive().optional()
 });
@@ -943,6 +1072,7 @@ const CustomDnsProviderSchema = object({
 const BuiltInDnsProviderSchema = discriminatedUnion("provider", [
 	HostingerDnsProviderSchema,
 	Route53DnsProviderSchema,
+	GoDaddyDnsProviderSchema,
 	CloudflareDnsProviderSchema,
 	ManualDnsProviderSchema
 ]);
@@ -965,6 +1095,7 @@ const DnsProviderSchema = union([BuiltInDnsProviderSchema, CustomDnsProviderSche
 * Supported providers:
 * - 'hostinger': Use Hostinger DNS API
 * - 'route53': Use AWS Route53
+* - 'godaddy': Use GoDaddy's v1 DNS API
 * - 'cloudflare': Use Cloudflare DNS API (future)
 * - 'manual': Don't create records, just print required records
 * - Custom: Provide a DnsProvider implementation
@@ -972,20 +1103,19 @@ const DnsProviderSchema = union([BuiltInDnsProviderSchema, CustomDnsProviderSche
 const DnsConfigSchema = record(string(), DnsProviderSchema);
 const HostingerDnsConfigSchema = HostingerDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
 const Route53DnsConfigSchema = Route53DnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
+const GoDaddyDnsConfigSchema = GoDaddyDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
 const CloudflareDnsConfigSchema = CloudflareDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
 const ManualDnsConfigSchema = ManualDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
 const CustomDnsConfigSchema = CustomDnsProviderSchema.extend({ domain: string().min(1, "Domain is required") });
 const BuiltInDnsConfigSchema = discriminatedUnion("provider", [
 	HostingerDnsConfigSchema,
 	Route53DnsConfigSchema,
+	GoDaddyDnsConfigSchema,
 	CloudflareDnsConfigSchema,
 	ManualDnsConfigSchema
 ]);
 const LegacyDnsConfigSchema = union([BuiltInDnsConfigSchema, CustomDnsConfigSchema]);
-/**
-* Combined DNS config that supports both new multi-domain and legacy single-domain formats.
-*/
-const DnsConfigWithLegacySchema = union([DnsConfigSchema, LegacyDnsConfigSchema]);
+union([DnsConfigSchema, LegacyDnsConfigSchema]);
 /**
 * Backups configuration schema.
 *
@@ -1075,15 +1205,12 @@ const DeployConfigSchema = object({
 	}).optional(),
 	/** Whose deploy this is, on a target shared with other workspaces. */
 	namespace: string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "deploy.namespace must be lowercase letters and digits with single '-' between them").optional(),
-	/** Each deployed stage's base domain (stage name -> domain). */
-	domains: record(string(), string()).optional(),
 	/** Where every target pushes and pulls the apps' images. */
 	registry: string().min(1).optional(),
 	dokploy: DokployWorkspaceConfigSchema.optional(),
 	compose: ComposeWorkspaceConfigSchema.optional(),
 	telemetry: TelemetryConfigSchema.optional(),
 	objects: ObjectsConfigSchema.optional(),
-	dns: DnsConfigWithLegacySchema.optional(),
 	backups: BackupsConfigSchema.optional()
 });
 /**
@@ -1276,6 +1403,10 @@ const WorkspaceConfigSchema = object({
 	*/
 	apps: record(string(), AppConfigSchema).optional(),
 	shared: SharedConfigSchema.optional(),
+	/** Each deployed stage's base domain (stage name -> domain). */
+	domains: record(string(), string()).optional(),
+	/** Each root domain's DNS provider, and how its hosts are pointed. */
+	dns: DnsConfigSchema.optional(),
 	deploy: DeployConfigSchema.optional(),
 	stages: StagesConfigSchema,
 	secrets: SecretsConfigSchema.optional(),
@@ -1341,6 +1472,59 @@ const WorkspaceConfigSchema = object({
 			path: ["deploy", "compose"]
 		});
 	}
+	const perStage = [
+		[
+			"domains",
+			["domains"],
+			data.domains
+		],
+		[
+			"deploy.objects",
+			["deploy", "objects"],
+			data.deploy?.objects
+		],
+		[
+			"deploy.telemetry",
+			["deploy", "telemetry"],
+			data.deploy?.telemetry
+		],
+		...Object.entries(data.dns ?? {}).map(([domain, entry]) => {
+			const records = entry.records;
+			const target = records && typeof records === "object" ? records.target : void 0;
+			return [
+				`dns['${domain}'].records.target`,
+				[
+					"dns",
+					domain,
+					"records",
+					"target"
+				],
+				target && typeof target === "object" ? target : void 0
+			];
+		})
+	];
+	for (const [setting, path, map] of perStage) try {
+		assertDeployedStageKeys(setting, map, data.stages);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path
+		});
+	}
+	for (const [domain, entry] of Object.entries(data.dns ?? {})) try {
+		checkDnsRecordsMode(domain, entry.records);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [
+				"dns",
+				domain,
+				"records"
+			]
+		});
+	}
 	if (data.state?.provider === "ssm" && !data.name) ctx.addIssue({
 		code: "custom",
 		message: "Workspace name is required when using SSM state provider. Add \"name\" to your gkm.config.ts.",
@@ -1402,6 +1586,8 @@ const WORKSPACE_KEYS = /* @__PURE__ */ new Set([
 	"constructs",
 	"apps",
 	"shared",
+	"domains",
+	"dns",
 	"deploy",
 	"stages",
 	"secrets",
@@ -1535,6 +1721,8 @@ function normalizeWorkspace(config, cwd) {
 		root: cwd,
 		...config.constructs ? { constructs: config.constructs } : {},
 		apps: normalizedApps,
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
 		deploy: config.deploy ?? { default: "dokploy" },
 		shared: config.shared ?? { packages: ["packages/*"] },
 		stages: validateStages(config.stages),
@@ -1580,6 +1768,8 @@ function wrapSingleAppAsWorkspace(config, cwd) {
 			runtime: config.runtime,
 			env: config.env
 		} },
+		...config.domains ? { domains: config.domains } : {},
+		...config.dns ? { dns: config.dns } : {},
 		deploy: {
 			default: "dokploy",
 			...config.deploy
@@ -1610,10 +1800,41 @@ var DokployRegistryMoved = class extends Error {
 		this.name = "DokployRegistryMoved";
 	}
 };
+/**
+* `deploy.domains`, which became `domains` at the root of the config: a stage's
+* domain is a fact about the product every target and every command reads,
+* not a deploy setting.
+*/
+var DomainsMoved = class extends Error {
+	domains;
+	constructor(domains) {
+		super(`deploy.domains is now domains, at the root of gkm.config.ts. Move it out of deploy: defineWorkspace({ …, domains: ${JSON.stringify(domains)}, deploy: { … } }).`);
+		this.domains = domains;
+		this.name = "DomainsMoved";
+	}
+};
+/**
+* `deploy.dns`, which became `dns` at the root of the config, keyed by root
+* domain.
+*/
+var DnsMoved = class extends Error {
+	dns;
+	constructor(dns) {
+		const legacy = dns && typeof dns === "object" && "domain" in dns && "provider" in dns;
+		const { domain, ...rest } = legacy ? dns : {};
+		super(`deploy.dns is now dns, at the root of gkm.config.ts, keyed by root domain. Move it out of deploy: defineWorkspace({ …, dns: ${JSON.stringify(legacy ? { [String(domain)]: rest } : dns)}, deploy: { … } }).`);
+		this.dns = dns;
+		this.name = "DnsMoved";
+	}
+};
 /** Refuse a deploy key that has moved, naming where it lives now. */
 function assertNoMovedDeployKeys(deploy) {
 	const dokploy = deploy?.dokploy;
 	if (dokploy && typeof dokploy === "object" && "registry" in dokploy) throw new DokployRegistryMoved(dokploy.registry);
+	if (deploy && typeof deploy === "object") {
+		if ("domains" in deploy) throw new DomainsMoved(deploy.domains);
+		if ("dns" in deploy) throw new DnsMoved(deploy.dns);
+	}
 }
 function processConfig(config, cwd) {
 	assertNoMovedDeployKeys(config.deploy);
@@ -1753,6 +1974,6 @@ function getEndpointForStage(dokployConfig, stage) {
 	return dokployConfig.endpoint;
 }
 //#endregion
-export { ComposeTlsFileMissing as $, UndeclaredStage as A, provisioningOf as B, getDeployTargetError as C, validateWorkspaceConfig as D, safeValidateWorkspaceConfig as E, resolveStageTelemetry as F, BucketKeySetElsewhere as G, S3_PROVISIONING as H, stageSampleRate as I, IamUserNotOwned as J, BucketNameUnavailable as K, telemetryEnv as L, deployedProblems as M, stageProblems as N, InvalidStages as O, otlpTelemetryEnv as P, S3RegionRequired as Q, LOGS_PORT as R, formatValidationErrors as S, isPhase2DeployTarget as T, checkS3Config as U, stageProvider as V, AccessKeyLimit as W, RecordedBucketUnreachable as X, ProvisionedBucketUnreachable as Y, RotationInProgress as Z, stripPublicPrefix as _, assertNoMovedDeployKeys as a, SUPPORTED_DEPLOY_TARGETS as b, getAppBuildOrder as c, normalizeWorkspace as d, certificateFor as et, processConfig as f, getPublicEnvPrefix as g, PUBLIC_ENV_PREFIXES as h, appConstructGlobs as i, assertDeployedStage as j, TEST_STAGE as k, getAppGkmConfig as l, wrapSingleAppAsWorkspace as m, InvalidWorkspaceConfig as n, SECRETS_STORE_PROVIDERS as nt, constructPatterns as o, workspaceConstructGlobs as p, BucketOwnedByAnotherProject as q, allConstructGlobs as r, UnknownSecretsStoreProvider as rt, defineWorkspace as s, DokployRegistryMoved as t, proxyFor as tt, getEndpointForStage as u, isWorkspaceConfig as v, isDeployTargetSupported as w, WorkspaceConfigSchema as x, PHASE_2_DEPLOY_TARGETS as y, UnknownStageProvider as z };
+export { RotationInProgress as $, InvalidStages as A, LOGS_PORT as B, WorkspaceConfigSchema as C, isPhase2DeployTarget as D, isDeployTargetSupported as E, stageProblems as F, checkS3Config as G, provisioningOf as H, otlpTelemetryEnv as I, BucketNameUnavailable as J, AccessKeyLimit as K, resolveStageTelemetry as L, UndeclaredStage as M, assertDeployedStage as N, safeValidateWorkspaceConfig as O, deployedProblems as P, RecordedBucketUnreachable as Q, stageSampleRate as R, SUPPORTED_DEPLOY_TARGETS as S, getDeployTargetError as T, stageProvider as U, UnknownStageProvider as V, S3_PROVISIONING as W, IamUserNotOwned as X, BucketOwnedByAnotherProject as Y, ProvisionedBucketUnreachable as Z, PUBLIC_ENV_PREFIXES as _, allConstructGlobs as a, SERVER_IPV6_KEY as at, isWorkspaceConfig as b, constructPatterns as c, SECRETS_STORE_PROVIDERS as ct, getAppGkmConfig as d, S3RegionRequired as et, getEndpointForStage as f, wrapSingleAppAsWorkspace as g, workspaceConstructGlobs as h, InvalidWorkspaceConfig as i, SERVER_IPV4_KEY as it, TEST_STAGE as j, validateWorkspaceConfig as k, defineWorkspace as l, UnknownSecretsStoreProvider as lt, processConfig as m, DokployRegistryMoved as n, certificateFor as nt, appConstructGlobs as o, cnameTarget as ot, normalizeWorkspace as p, BucketKeySetElsewhere as q, DomainsMoved as r, proxyFor as rt, assertNoMovedDeployKeys as s, isReservedStageKey as st, DnsMoved as t, ComposeTlsFileMissing as tt, getAppBuildOrder as u, getPublicEnvPrefix as v, formatValidationErrors as w, PHASE_2_DEPLOY_TARGETS as x, stripPublicPrefix as y, telemetryEnv as z };
 
-//# sourceMappingURL=workspace-D2CYLMCW.mjs.map
+//# sourceMappingURL=workspace-CJ0lKFq-.mjs.map